aaPanel iss accepting invalid sub domains

ta_ihpoj1jophi_at

Hello friends,
I noticed that catch-all configurated webs are accepting "www-" as a sub domain (in my case: Apache 2), e.g.: https://www-.example.com - I noticed it by chance because of a typo. It lead to the phenomenon that some PHP-globals are containing garbage (HOST for instance is empty). I'm not sure if there are security risks because of this typo. I'm also not sure about the correctness of the place to report it. But aaPanel is the panel I use.

Greetings,
Jo

aaPanel_Captain

Do you mean that when adding a subdomain of www, a wrong input will cause other settings to go wrong?

ta_ihpoj1jophi_at

aaPanel_Captain Thanks for your reply.

Yes, for e.g. https://www-.jophi.cc loads the web, but global variables like $_SERVER['HOST'] are empty. If there are further issues caused by this, or if aaPanel's functionality is directly affected by this, I cannot figure it out, but I'm afraid that it could be.

Most of are afraid of manipulated query strings. Now I'm afraid of manipulated host-/domain names.

I currently deny this type of requests manually. No server should accept illegal naming. I'm just afraid that this could be abused. As I know, it's not allowed to use a subdomain starting or ending with a "-". There are further rules, I haven't tested yet.

I was not sure where I can/could/should report it. I decided for this forum, because I think that it's the best place for it. Devs/Users on one place. If it's a bug of aaPanel, it could be solved. If it's a bug in Apache2, devs of aaPanel could report it.

I'm also not able to say that this phenomenon is exclusively bounded to aaPanel. I also can just talk in combination to Apache2. I'm in lack of other options where I'm able to test it.

Greetings from Austria,
Jo

ta_ihpoj1jophi_at

aaPanel_Captain ,
and no:
I'm talking about a catch all domain:
for e.g. *.jophi.cc (which I added to the web with aaPanel)
It is also accepting www-.jophi.cc (illegal naming), which leads to troubles.

ta_ihpoj1jophi_at

aaPanel_Captain , as mentioned before. Please delete this thread. I have no chance to withdraw it.

ta_ihpoj1jophi_at

And with "it accepts" I mean the responding server, after typing it into the adressbar of the browser.

ta_ihpoj1jophi_at

I tested several more at the web browser's address field. Now, it's getting critical:
https://-.jophi.cc
https://*.jophi.cc

For any reason, aaPanel delivers the SSL-certificate of the panel itself, now it's a security risk, i cannot keep the panel's URL seecret. (as long as I use at least one catch all domain)

aaPanel_Captain

ta_ihpoj1jophi_at I will test according to what you said today to see if it can be reproduced

ta_ihpoj1jophi_at

Thank you so much! 🤗

ta_ihpoj1jophi_at

Additional exploration:
https://lll.ttt.jophi.cc/ delivers the certificate for jophi.cc, certainly it's invalid, because of the additional
label, but it reacts as intended.

But: https://lll-.ttt.jophi.cc/ is again delivering aapanels hostname. On Safari mobile with SSL-certificate and an accepted request for jophi.cc, on Chrome Desktop without ssl-certificate but with a bad request message (submitted by aapanel.jophi.guru instead of jophi.cc)

In all tested scenarios, I cannot keep aapanels URL secret.

Greetings,
Jo

ta_ihpoj1jophi_at

Bump! 🙂

ta_ihpoj1jophi_at

I want to delete/remove this thread, but I cannot! Nothing happens about this.

@aaPanel_Jose ?