poslop/palette
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases 2 Wiki Activity

[pentest] Missing security headers and no HSTS; HTTP->HTTPS redirect reflects arbitrary Host header #67

New Issue
Closed
opened 2026-09-09 14:10:09 +00:00 by poslop · 1 comment
poslop commented 2026-09-09 14:10:09 +00:00
Owner
Copy Link
Copy Source

Observed on dev build:

  1. Responses (port 443 and 80) carry no CSP, X-Frame-Options, HSTS, or Referrer-Policy headers (only content-type, set-cookie). Paste pages render user-controlled titles; defense-in-depth absent.
  2. curl -H 'Host: evil.example.com' http://10.0.1.47/ -> 301 Location: https://evil.example.com/ - the HTTP->HTTPS redirect blindly reflects the attacker-supplied Host header (host-header injection / cache poisoning vector where a proxy caches the redirect).

Recommend: set HSTS, CSP, X-Content-Type-Options (present only on /raw), X-Frame-Options; derive redirect location from allowlist.

Observed on dev build: 1. Responses (port 443 and 80) carry **no** CSP, X-Frame-Options, HSTS, or Referrer-Policy headers (only content-type, set-cookie). Paste pages render user-controlled titles; defense-in-depth absent. 2. `curl -H 'Host: evil.example.com' http://10.0.1.47/` -> `301 Location: https://evil.example.com/` - the HTTP->HTTPS redirect blindly reflects the attacker-supplied Host header (host-header injection / cache poisoning vector where a proxy caches the redirect). Recommend: set HSTS, CSP, X-Content-Type-Options (present only on /raw), X-Frame-Options; derive redirect location from allowlist.
poslop commented 2026-09-09 15:18:44 +00:00
Author
Owner
Copy Link
Copy Source

Fully remediated and live-verified 2026-09-09:

  • App security headers: merged via PR #76 (CSP, Referrer-Policy, nosniff on all HTML)
  • HSTS: Traefik entrypoint middleware kube-system-hsts@kubernetescrd (max-age=31536000, includeSubDomains, preload) - verified on palette + palette-dev
  • HTTP->HTTPS: Traefik web entrypoint now 308-redirects to websecure (no more Host-reflection, fixed target)
  • Other services on the proxy (gitea etc) verified unaffected

Changes committed in poslop/k3s (values.yaml + hsts-middleware.yaml).

Fully remediated and live-verified 2026-09-09: - App security headers: merged via PR #76 (CSP, Referrer-Policy, nosniff on all HTML) - HSTS: Traefik entrypoint middleware `kube-system-hsts@kubernetescrd` (max-age=31536000, includeSubDomains, preload) - verified on palette + palette-dev - HTTP->HTTPS: Traefik web entrypoint now 308-redirects to websecure (no more Host-reflection, fixed target) - Other services on the proxy (gitea etc) verified unaffected Changes committed in poslop/k3s (values.yaml + hsts-middleware.yaml).
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Assigned
Owner assigned: agent may pick this up
 Critical
critical severity (pentest triage)
 High
high severity (pentest triage)
 In Progress
Agent actively working on this
 Low
low severity (pentest triage)
 Medium
medium severity (pentest triage)
 Owner Review
Blocked on a human decision or design call - poslop must review before work proceeds
 QA
Implementation done, awaiting independent review agent
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
fen poslop
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: poslop/palette#67