<div dir="ltr"><div>Hi all,</div><div><br></div><div>New to the mailing list and a complete newbie to openssl and the likes. There's a ticket by a client that I'm new at and he claims that there's a security problem with the openssl command to his servers.</div><div>
<p>Internal IP exposed after running a openssl (version 1.1.0j) connect command:</p>
<pre><code>openssl s_client -connect 103.XX.XXX.XX:10443 -quiet
</code></pre>
<p>Where 103.XX.XXX.XX is a Public IP. And after it shows the certificates, typed the following:</p>
<pre><code>GET /images HTTP/1.0
</code></pre>
<p>And hit enter twice, the following gets displayed:</p>
<pre><code>HTTP/1.0 301 Moved Permanently
Date: Mon, 25 Mar 2019 00:10:13 GMT
Server: xxxxxxxx-xxxxx
Location: <a href="https://10.240.123.1:10443/images/">https://10.240.123.1:10443/images/</a>
Connection: close
Content-Type: text/html; charset=utf-8
X-Frame-Options: SAMEORIGIN
Content-Security-Policy: frame-ancestors 'self'
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=28800
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<HTML><HEAD>
<TITLE>301 Moved Permanently</TITLE>
</HEAD><BODY>
<H1>Moved Permanently</H1>
The document has moved <A HREF="<a href="https://10.240.123.1:10443/images/">https://10.240.123.1:10443/images/</a>">here</A>.<P>
</BODY></HTML>
read:errno=0
</code></pre>
<p>The 10.240.123.1 is an internal IP and it is exposed by this little method. Although not shown when using <code>curl -kv -O</code> command.</p>
<p>Is there a way to cover up the "Location" or at least the internal IP from being exposed? Thanks.</p>
</div><div>Sorry if this isn't clear or if this is the wrong place to ask this.</div><div><br>-- <br><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">Abdul Qoyyuum Bin Haji Abdul Kadir<div>HP No: +673 720 8043</div></div></div></div></div>