Given
A Pangolin resource is configured to always allow access from a specific IP range and disallow access from all other IP ranges.
When
A user from outside of the allowed IP range accesses that resource
Then
Current behavior
Pangolin returns a 401 Unauthorized
This allows to enumerate all resource that are present on a Pangolin instance that the user does not have access to and potentially target specific services. E.g. if a user knows that vaultwarden.mydomain.com exists, than he also knows that there are probably rules that always allow access to specific paths like /api/* that he could try to exploit.
Proposed behavior
Pangolin should return the same response as if the resource was not found, so a non-existing resource is not differentiable from a resource that access was denied to.
Added after some Discord discussion: This only applies to the response presented to the user. Internal backend tools like CrowdSec might rely on the 401 (or 403) code.
References
OWASP: Enumerate Applications on Webserver
Given
A Pangolin resource is configured to always allow access from a specific IP range and disallow access from all other IP ranges.
When
A user from outside of the allowed IP range accesses that resource
Then
Current behavior
Pangolin returns a 401 Unauthorized
This allows to enumerate all resource that are present on a Pangolin instance that the user does not have access to and potentially target specific services. E.g. if a user knows that vaultwarden.mydomain.com exists, than he also knows that there are probably rules that always allow access to specific paths like
/api/*that he could try to exploit.Proposed behavior
Pangolin should return the same response as if the resource was not found, so a non-existing resource is not differentiable from a resource that access was denied to.
Added after some Discord discussion: This only applies to the response presented to the user. Internal backend tools like CrowdSec might rely on the 401 (or 403) code.
References
OWASP: Enumerate Applications on Webserver