R
Railway•6mo ago
macwilko

Odd logs coming up in Redis

1:M 14 Dec 2023 15:00:33.775 # Possible SECURITY ATTACK detected. It looks like somebody is sending POST or Host: commands to Redis. This is likely due to an attacker attempting to use Cross Protocol Scripting to compromise your Redis instance. Connection from 192.168.32.4:17944 aborted.
1:M 14 Dec 2023 15:00:33.775 # Possible SECURITY ATTACK detected. It looks like somebody is sending POST or Host: commands to Redis. This is likely due to an attacker attempting to use Cross Protocol Scripting to compromise your Redis instance. Connection from 192.168.32.4:17944 aborted.
@Brody @Vin
23 Replies
Percy
Percy•6mo ago
Project ID: dd3f96f7-3ab3-4453-86a3-32328b2f81d6
macwilko
macwilko•6mo ago
dd3f96f7-3ab3-4453-86a3-32328b2f81d6 is there a way to determine what
192.168.32.4:17944
192.168.32.4:17944
was ?
Brody
Brody•6mo ago
that's a local address, likely the dashboard trying to connect
macwilko
macwilko•6mo ago
for reference, I haven't connected via any redis client that's strange, you mean the railway dashboard?
Brody
Brody•6mo ago
yeah, that's my guess, but whatever it is, it's a local address so it's not an attack
macwilko
macwilko•6mo ago
idk strikes me as very strange if it's caused by the railway dashboard, woudln't that be easy to determine?
Brody
Brody•6mo ago
do you have the tcp proxy enabled?
macwilko
macwilko•6mo ago
you mean, exposed to the public web?
Brody
Brody•6mo ago
I mean do you have the tcp proxy enabled on the redis service
macwilko
macwilko•6mo ago
(it was previously) i'ved turned it off not sure what that is (tcp proxy)
Brody
Brody•6mo ago
you definitely know what it is
macwilko
macwilko•6mo ago
No description
macwilko
macwilko•6mo ago
(there was previously a generated domain ... which I could use to connect to it outside railway) i turned it off now
Brody
Brody•6mo ago
that would be a tcp proxy
macwilko
macwilko•6mo ago
right 😄
jr
jr•6mo ago
If you don't have the tcp proxy enabled Railway will attempt to make a request to the open port (in this case 6379) so that we can suggest adding a domain if necessary.
Brody
Brody•6mo ago
mystery solved
macwilko
macwilko•6mo ago
hey, when this error happened, the tcp proxy was enabled. It was something like viaduct.proxy.rlwy.net:49184
Brody
Brody•6mo ago
mac, its a local address
jr
jr•6mo ago
Oh just checked and turns out we make the request regardless
macwilko
macwilko•6mo ago
ok 🙂
jr
jr•6mo ago
I’ll raise with team though. Seeing that message in the logs is very cryptic indeed
macwilko
macwilko•6mo ago
yes, am i the first to notice it? It's a little odd looking.