Page MenuHomePhorge
Create Task
Maniphest T268

Loopback user activity
Closed, ResolvedPublic
Actions

Description

http://www.shoutwiki.com/w/index.php?title=Special:AbuseLog&wpSearchUser=127.0.0.1
... shows that an unregistered user attempted to create spam pages. Although it's possible to spoof the TCP source address of a packet as anything, it's not possible to establish a TCP session that way. Ordinarily only someone logged in to the OS should have access to the loopback interface. A locally running proxy is another possibility, if it exists. Either way, it warrants investigation.

Event Timeline

Saftzie created this task.Feb 12 2020, 6:54 PM
Saftzie added a project: Restricted Project.Feb 12 2020, 6:59 PM

BTW, there appears to be no such thing as a #security tag in this phabricator ....

Saftzie removed a project: Restricted Project.Jun 25 2020, 11:58 PM
Saftzie removed a subscriber: Saftzie.Jun 26 2020, 12:03 AM
lewiscawte closed this task as Resolved.Feb 28 2023, 12:22 AM
lewiscawte claimed this task.
lewiscawte triaged this task as Normal priority.
lewiscawte added projects: Restricted Project, Restricted Project.
lewiscawte added a subscriber: lewiscawte.

I expect it's the frontend cache and/or SSL terminator incorrectly handling the forwarded headers. We were still very much testing that and the mobile detection in the frontend at this time. Haven't seen a reoccurrence recently, closing until it needs reopening?