[Security Enhancement] Prevent enumeration of pangolin resources #1127

New Issue

MrUnknownDE · 2026-04-05T18:19:28+02:00

MrUnknownDE commented

2026-04-05 18:19:28 +02:00

Originally created by @TheConen on 8/2/2025

Given

A Pangolin resource is configured to always allow access from a specific IP range and disallow access from all other IP ranges.

When

A user from outside of the allowed IP range accesses that resource

Then

Current behavior

Pangolin returns a 401 Unauthorized

This allows to enumerate all resource that are present on a Pangolin instance that the user does not have access to and potentially target specific services. E.g. if a user knows that vaultwarden.mydomain.com exists, than he also knows that there are probably rules that always allow access to specific paths like /api/* that he could try to exploit.

Proposed behavior

Pangolin should return the same response as if the resource was not found, so a non-existing resource is not differentiable from a resource that access was denied to.

Added after some Discord discussion: This only applies to the response presented to the user. Internal backend tools like CrowdSec might rely on the 401 (or 403) code.

References

OWASP: Enumerate Applications on Webserver

*Originally created by @TheConen on 8/2/2025* ## Given A Pangolin resource is configured to always allow access from a specific IP range and disallow access from all other IP ranges. <img width="1591" height="413" alt="Image" src="https://github.com/user-attachments/assets/272e61dc-d396-41aa-b00d-a2ffa7dc44d7" /> ## When A user from outside of the allowed IP range accesses that resource ## Then ### Current behavior Pangolin returns a 401 Unauthorized <img width="1297" height="451" alt="Image" src="https://github.com/user-attachments/assets/54a250ac-4db9-4b60-8520-15c72f525874" /> This allows to enumerate all resource that are present on a Pangolin instance that the user does not have access to and potentially target specific services. E.g. if a user knows that vaultwarden.mydomain.com exists, than he also knows that there are probably rules that always allow access to specific paths like `/api/*` that he could try to exploit. ### Proposed behavior Pangolin should return the same response as if the resource was not found, so a non-existing resource is not differentiable from a resource that access was denied to. Added after some Discord discussion: This only applies to the response presented to the user. Internal backend tools like CrowdSec might rely on the 401 (or 403) code. <img width="1060" height="274" alt="Image" src="https://github.com/user-attachments/assets/bcfe2519-d55a-415a-b138-f6ad6f52a6ab" /> ## References [OWASP: Enumerate Applications on Webserver](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/01-Information_Gathering/04-Enumerate_Applications_on_Webserver)

MrUnknownDE closed this issue

2026-04-05 18:19:28 +02:00

MrUnknownDE added the enhancement reverse proxy enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement reverse proxy labels 2026-04-05 18:19:29 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement reverse proxy reverse proxy

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#1127