【发布时间】：2022-02-21 17:32:39
【问题描述】：
我有一个 k8s 部署，它使用 Cloud DNS 和 托管证书（用于 SSL） 以及 k8s 服务。
我已经根据this GKE documentation配置了HTTP转HTTPS
它工作得非常好，并将我的 HTTP 请求重定向到 HTTPS 网站。
现在，当我使用 CMD 中的以下命令测试 HOST HEADER INJECTION 的漏洞时，
curl http://staging.mysite.com --header 'Host: malicious.com'
我收到如下回复
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>301 Moved</TITLE></HEAD><BODY>
<H1>301 Moved</H1>
The document has moved
<A HREF="https://malicious.com/">here</A>.
</BODY></HTML>
顺便提一下，我的应用是基于 angular 11 构建的，构建后我使用 Nginx 为应用提供服务。
这是我的入口和前端配置和托管证书配置
apiVersion: networking.gke.io/v1beta1
kind: FrontendConfig
metadata:
name: ssl-redirect
spec:
redirectToHttps:
enabled: true
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: staging-service-ingress
annotations:
kubernetes.io/ingress.global-static-ip-name: staging-global-ip
networking.gke.io/managed-certificate: staging-cert
networking.gke.io/v1beta1.FrontendConfig: ssl-redirect
spec:
defaultBackend:
service:
name: web-staging-service
port:
number: 80
rules:
- host: staging.mysite.com
http:
paths:
- backend:
service:
name: web-staging-service
port:
number: 80
pathType: ImplementationSpecific
path: /*
---
apiVersion: networking.gke.io/v1
kind: ManagedCertificate
metadata:
name: staging-cert
spec:
domains:
- staging.mysite.com
这是我的 Nginx 配置
worker_processes 4;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;
events { worker_connections 1024; }
http {
server {
listen 80;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256';
ssl_prefer_server_ciphers on;
server_tokens off;
server_name *.mysite.com, mysite.com;
types {
module js;
}
sendfile on;
include /etc/nginx/mime.types;
gzip on;
gzip_http_version 1.1;
gzip_disable "MSIE [1-6]\.";
gzip_min_length 256;
gzip_vary on;
gzip_proxied expired no-cache no-store private auth;
gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;
gzip_comp_level 9;
location / {
root /usr/share/nginx/html;
try_files $uri $uri/ /index.html;
index index.html index.htm;
}
error_page 404 500 502 503 504 /404.html;
location = /404.html {
root /usr/share/nginx/html;
}
}
add_header Strict-Transport-Security "max-age=31536000;" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Frame-Options sameorigin always;
add_header X-Content-Type-Options nosniff;
add_header Referrer-Policy 'origin';
add_header Content-Security-Policy "some rules";
add_header Permissions-Policy "some rules";
}
我没有找到任何正确的方法来阻止注射。该应用程序在当前配置下完美运行。
请帮助我找到防止主机头注入的正确解决方案
【问题讨论】：
标签： angular nginx kubernetes google-cloud-platform google-kubernetes-engine