Znc leaks the local IP of the machine it's running on. #510

New Issue

2026-10-05T04:26:04+02:00

adam commented

2026-10-05 04:26:04 +02:00

On a 404, ZNC leaks the local IP of the server, even if you are not logged in.
I don't think, this is bad but it shouldn't happen, it's way too much information.

https://github.com/znc/znc/blob/master/src/HTTPSock.cpp#L650

On a 404, ZNC leaks the local IP of the server, even if you are not logged in. I don't think, this is bad but it shouldn't happen, it's way too much information. https://github.com/znc/znc/blob/master/src/HTTPSock.cpp#L650

adam closed this issue

2026-10-05 04:26:05 +02:00

adam commented

2026-10-05 04:26:06 +02:00

The local IP being the address that the client used to connect to the server in the first place? It's hardly a leak if the client already had that info.

The local IP being the address that the client used to connect to the server in the first place? It's hardly a leak if the client already had that info.

adam commented

2026-10-05 04:26:06 +02:00

https://178.x.x.x:port/blablabla
Results:

Not Found
The requested URL was not found on this server.
ZNC - http://znc.in at 192.168.0.213 Port 1025

it should grab whatever is in the Host header instead of the ip

https://178.x.x.x:port/blablabla Results: Not Found The requested URL was not found on this server. ZNC - http://znc.in at 192.168.0.213 Port 1025 it should grab whatever is in the Host header instead of the ip

adam commented

2026-10-05 04:26:07 +02:00

Well, that IP isn't accessible outside of your LAN, so it's not too big of a deal. I haven't tested this, but it's probably possible to change the listening ports around so that ZNC will pick the external IP instead, if that's what you'd rather have displayed. Doubt it's possible to show the hostname instead without code changes, but let's see what others think.

Well, that IP isn't accessible outside of your LAN, so it's not too big of a deal. I haven't tested this, but it's probably possible to change the listening ports around so that ZNC will pick the external IP instead, if that's what you'd rather have displayed. Doubt it's possible to show the hostname instead without code changes, but let's see what others think.

adam commented

2026-10-05 04:26:07 +02:00

Why do we even output that IP/port at all? Browser usually knows that already

Why do we even output that IP/port at all? Browser usually knows that already

adam commented

2026-10-05 04:26:08 +02:00

I don't think this is that much of an issue.

Consider: A ZNC is at example.com with public IP 1.2.3.4 on port 1234. The DNS entry for example.com is 1.2.3.4. The IP is a public IP and ZNC binds to it. The IP is already public knowledge by looking at DNS so ZNC leaking it isn't really an issue

Consider 2: A ZNC is on 192.168.1.10 inside a network with 1.2.3.4 on port 9999. The dynamic DNS is something.no-ip. The DNS entry shows the public IP (nonissue as in previous example). The ZNC leaks the internal IP of 192.168.1.10 which is a private IP space and won't really be considered a security risk since an internal IP can only be reached through NAT on the gateway box unless a public IP is statically routed from the gateway to the internal. Again, nonissue.

Whether ZNC shows the IP or not going forward, how is the IP being displayed that much of an issue, given you can do a packet sniff or DNS to find the public IP anyways?

I don't think this is that much of an issue. Consider: A ZNC is at example.com with public IP 1.2.3.4 on port 1234. The DNS entry for example.com is 1.2.3.4. The IP is a public IP and ZNC binds to it. The IP is already public knowledge by looking at DNS so ZNC leaking it isn't really an issue Consider 2: A ZNC is on 192.168.1.10 inside a network with 1.2.3.4 on port 9999. The dynamic DNS is something.no-ip. The DNS entry shows the public IP (nonissue as in previous example). The ZNC leaks the internal IP of 192.168.1.10 which is a private IP space and won't really be considered a security risk since an internal IP can only be reached through NAT on the gateway box unless a public IP is statically routed from the gateway to the internal. Again, nonissue. Whether ZNC shows the IP or not going forward, how is the IP being displayed that much of an issue, given you can do a packet sniff or DNS to find the public IP anyways?

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adam/znc#510