Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

security problem node inspect v6.14.3 #21349

Closed
magicode opened this issue Jun 15, 2018 · 2 comments
Closed

security problem node inspect v6.14.3 #21349

magicode opened this issue Jun 15, 2018 · 2 comments
Labels
c++ Issues and PRs that require attention from people who are familiar with C++. experimental Issues and PRs related to experimental features. help wanted Issues that need assistance from volunteers or PRs that need help to proceed. inspector Issues and PRs related to the V8 inspector protocol security Issues and PRs related to security.

Comments

@magicode
Copy link

  • Version: v6.14.3
  • Platform: Linux
  • Subsystem: Ubuntu 16

run node like this

➜  ~ $ node --inspect="127.0.0.1:9876" -e "setTimeout(function() { console.log('yes'); }, 30000)"
Debugger listening on port 9876.
Warning: This is an experimental feature and could change at any time.
To start debugging, open the following URL in Chrome:
    chrome-devtools://devtools/remote/serve_file/@60cd6e859b9f557d2312f5bf532f6aec5f284980/inspector.html?experiments=true&v8only=true&ws=127.0.0.1:9876/b41558bd-24a7-4828-ab57-16f7f7f231fa

and run

➜  ~ $  netstat -lpn
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:9876            0.0.0.0:*               LISTEN      19879/node      

node writes that he listens to 127.0.0.1 and actually listens to 0.0.0.0

@targos targos added v6.x inspector Issues and PRs related to the V8 inspector protocol labels Jun 15, 2018
@bnoordhuis
Copy link
Member

I can confirm what you're seeing and it's no surprise because the bind address is hard-coded to 0.0.0.0.

That was fixed as part of ongoing work in ba776b3 but the inspector in v6.x had been frozen before that. It never moved out of experimental status due to limitations in V8 5.1.

v6.x is in maintenance mode now and this issue doesn't qualify as a security bug because the inspector is experimental, so I guess it remains to be seen what can be done.

We won't/can't back-port all the work that has gone into the inspector since then and unilaterally changing the bind address to 127.0.0.1 will probably break some users but it should be possible to thread through debug_host from src/node.cc to src/inspector_agent.cc. Pull requests welcome.

@bnoordhuis bnoordhuis added help wanted Issues that need assistance from volunteers or PRs that need help to proceed. c++ Issues and PRs that require attention from people who are familiar with C++. labels Jun 15, 2018
@ChALkeR ChALkeR added security Issues and PRs related to security. experimental Issues and PRs related to experimental features. labels Jun 15, 2018
bnoordhuis added a commit to bnoordhuis/io.js that referenced this issue Jun 17, 2018
Change the bind address from 0.0.0.0 to 127.0.0.1 and start respecting
the address part of `--inspect=<address>:<port>` so that the bind
address can be overridden by the user.

Fixes: nodejs#21349
@bengl
Copy link
Member

bengl commented Nov 29, 2018

Closing since this is fixed now.

@bengl bengl closed this as completed Nov 29, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
c++ Issues and PRs that require attention from people who are familiar with C++. experimental Issues and PRs related to experimental features. help wanted Issues that need assistance from volunteers or PRs that need help to proceed. inspector Issues and PRs related to the V8 inspector protocol security Issues and PRs related to security.
Projects
None yet
Development

No branches or pull requests

5 participants