Stuck on an issue?
Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.
And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.
mitmweb isn't protected against DNS rebinding
See original GitHub issueThe mitmweb interface does not seem to include protection against DNS rebinding. This could be exploited by a malicious website to either access the sniffed data or run arbitrary Python scripts on the filesystem by setting the scripts config option.
I have hacked together a PoC here (nothing really special to be seen though).
Issue Analytics
- State:
- Created 5 years ago
- Reactions:1
- Comments:12 (2 by maintainers)
Top Results From Across the Web
DNS Rebinding in mitmproxy | CVE-2018-14505 | Snyk
Affected versions of this package are vulnerable to DNS Rebinding. The mitmweb interface did not include protection against DNS rebinding.
Read more >DNS rebinding explained - dev/posts
If the services of the target server are protected by some form of authentication, the attacker will not be able to leverage the...
Read more >CVE-2018-14505 | Vulnerability Database - Debricked
mitmweb in mitmproxy v4.0.3 allows DNS Rebinding attacks, related to tools/web/app.py. ... mitmweb isn't protected against DNS rebinding · Issue #3234 ...
Read more >DNS Rebinding Protections | pfSense Documentation
DNS rebinding attack protection is active by default. This behavior is controlled by the DNS Rebind Check option under System > Advanced, Admin ......
Read more >Search Results - CVE
This is due to flawed DNS rebinding protection. ... Home and Chromecast devices before mid-July 2018 does not prevent DNS rebinding attacks from...
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Yes would love for this to be configurable.
Would also like to know if this can be disabled - my instance is behind a reverse proxy so I am presuming this is safe enough for what I need it for, and accessing it externally would be helpful.