Vhost request for apps might expose locally running servers or other website data

amahi / amahi-anywhere-fs

Amahi Anywhere file server

GNU General Public License v3.0

12 stars 10 forks source link

Vhost request for apps might expose locally running servers or other website data #7

Closed csoni111 closed 6 years ago

csoni111 commented 6 years ago

Currently one can access any local server running on the hda machine using Vhost/? in User-Agent header, for example Vhost/localhost:3000/blah-blah or even more vulnerable could be Vhost/anywebsite.com.