Skip to content

Security Issue on dokodemo inbounds #1213

Closed
@XRaySup

Description

@XRaySup

Describe the bug
Dokodemo Inbound works as a proxy server. it seems that if we provide a sni to the inbound port then the server forwards the connection to the provided sni without any restriction. it looks like a security issue

To Reproduce
Steps to reproduce the behavior:

  1. First server: Create a dokodemo inbound on port i.e. 443 with whatever target IP you want.(should not be the second server IP)
  2. Use an existing Vless was tls config. it can be any other protocol with tls security. make sure the config is working fine.
  3. Change the address in the config to the first server IP address
  4. make sure the config has a valid sni and host parameter similar to certificates for tls.
  5. in this case the first server IP address works as clean IP and passes all traffic.

Expected behavior
I expect that Dekodomo only forwards the traffic to the target IP.
it looks like some users scan all Iran VPS providers' IPs, and then use these local IPs as clean IP.
so they can use these IPs and overload the VPS.

we have seen this issue on the latest version of Sanaei but did not check on the Alireza Panel,
the source issue might be from the Xray core.

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or requestto deployTo be deployed during the time

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions