Invalid HOST Header from router IP

user_10796680 0
Viewed 1276

I keep getting an Invalid HOST Header error which I am trying to find the cause of. It reads as such:

Report at /GponForm/diag_Form
Invalid HTTP_HOST header: '192.168.0.1:443'. You may need to add '192.168.0.1' to ALLOWED_HOSTS

I do not know what /GponForm/diag_Form is but from the looks of it, it may be a vulnerability attacked by malware.

I also am wondering why the IP is from a router 192.168.0.1 as well as why it is coming through SSL :443

Should I consider putting a HoneyPot and blocking this IP address? Before I do, why does the IP look like a local router?

The full Request URL in the report looks like this:

Request URL: https://192.168.0.1:443/GponForm/diag_Form?style/

I am getting this error at least ~10x/day now so I would like to stop it.

networking security django
1 Answers

Yes, this surely represents a vulnerability - someone tried to access this url on router (which usually have ip 192.168.0.1).

It looks so because request from attacker contains HOST header with this value.

Maybe django is run locally with DEBUG=True.

You may consider running it more production wised with web-server (i.e. nginx) in front filtering unwanted requests with nginx config and further adding fail2ban to parse nginx error logs and ban ip.

Or make site available only from specific ips / ads simple authorization, i.e. Basic Auth on web-server level.

Previous irrelevant answer

ALLOWED_HOSTS option specifies domains django project can serve.

In running locally - python manage.py runserver or with DEBUG=True - it defaults to localhost, 127.0.0.1 and similar.

If you are accessing django via different url - it will complain in such a manner.

To allow access from another domains - add them to ALLOWED_HOSTS: ALLOWED_HOSTS = ['localhost', '127.0.0.1', '[::1]', '192.168.0.1'].

user_125203500
Related