langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-08-24 22:11:36 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

[Security] SSRF detection triggered by Squid proxy default config in Docker container #17549

New Issue
Closed
opened 2026-02-21 19:36:43 -05:00 by yindo · 0 comments
yindo commented 2026-02-21 19:36:43 -05:00
Owner
Copy Link
Copy Source

Originally created by @leeyisoft on GitHub (Sep 16, 2025).

Self Checks

  • I have read the Contributing Guide and Language Policy.
  • This is only for bug report, if you would like to ask a question, please head to Discussions.
  • I have searched for existing issues search for existing issues, including closed ones.
  • I confirm that I am using English to submit this report, otherwise it will be closed.
  • 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：）
  • Please do not modify this template :) and fill in all the required fields.

Dify version

1.1.3 and 1.8.1

Cloud or Self Hosted

Self Hosted (Docker)

Steps to reproduce

Description

While using the Dify SSRF proxy Docker container, an alert from Alibaba Cloud security detected a suspicious DNSLog access. It appears that the default Squid configuration may have a potential SSRF security risk. For reference, the relevant Squid configuration snippets and the original Alibaba Cloud alert are provided below.

Squid Configuration Snippets (original, unmodified)

1) /etc/squid/squid.conf

docker exec -it docker-ssrf_proxy-1 cat /etc/squid/squid.conf

acl localnet src 0.0.0.1-0.255.255.255  # RFC 1122 "this" network (LAN)
acl localnet src 10.0.0.0/8             # RFC 1918 local private network (LAN)
acl localnet src 100.64.0.0/10          # RFC 6598 shared address space (CGN)
acl localnet src 169.254.0.0/16         # RFC 3927 link-local (directly plugged) machines
acl localnet src 172.16.0.0/12          # RFC 1918 local private network (LAN)
acl localnet src 192.168.0.0/16         # RFC 1918 local private network (LAN)
acl localnet src fc00::/7               # RFC 4193 local private network range
acl localnet src fe80::/10              # RFC 4291 link-local (directly plugged) machines
acl SSL_ports port 443
# acl SSL_ports port 1025-65535   # Enable the configuration to resolve this issue: https://github.com/langgenius/dify/issues/12792
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl CONNECT method CONNECT
acl allowed_domains dstdomain .marketplace.dify.ai
http_access allow allowed_domains
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
http_access deny manager
http_access allow localhost
include /etc/squid/conf.d/*.conf
http_access deny all

################################## Proxy Server ################################
http_port 3128
coredump_dir /var/spool/squid
refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
refresh_pattern .               0       20%     4320

# cache_dir ufs /var/spool/squid 100 16 256
# upstream proxy, set to your own upstream proxy IP to avoid SSRF attacks
# cache_peer 172.1.1.1 parent 3128 0 no-query no-digest no-netdb-exchange default 

################################## Reverse Proxy To Sandbox ################################
http_port 8194 accel vhost
cache_peer sandbox parent 8194 0 no-query originserver
acl src_all src all
http_access allow src_all

# Unless the option's size is increased, an error will occur when uploading more than two files.
client_request_buffer_max_size 100 MB

2) /etc/squid/conf.d/debian.conf

docker exec -it docker-ssrf_proxy-1 cat /etc/squid/conf.d/debian.conf
#
# Squid configuration settings for Debian
#

# Logs are managed by logrotate on Debian
logfile_rotate 0

# For extra security Debian packages only allow
# localhost to use the proxy on new installs
#
http_access allow localnet

3) /etc/squid/conf.d/rock.conf

docker exec -it docker-ssrf_proxy-1 cat /etc/squid/conf.d/rock.conf
# Set max_filedescriptors to avoid using system's RLIMIT_NOFILE. See LP: #1978272
max_filedescriptors 1024

Environment

  • Dify SSRF proxy Docker container
  • Ubuntu / official Squid latest image
  • Alibaba Cloud ECS + internal VPC

✔️ Expected Behavior

  1. The Squid proxy in the Docker container should only allow internal network access and not trigger public SSRF alerts.
  2. The reverse proxy (port 8194) should only communicate with the sandbox.
  3. Request official confirmation on whether these default configurations have potential SSRF security risks, and guidance for secure configuration.

❌ Actual Behavior

Alibaba Cloud Alert (original)

Reason: Process accessed suspicious DNSLog domain

Data Source: DNS domain access triggered detection

Domain: d3507m1lt95oel1itqk0k17fxedhka9ng.oast.pro

Process ID: 7513

Command: /usr/sbin/squid -f /etc/squid/squid.conf -NYC 1

Process Path: /usr/sbin/squid

Parent PID: 6166

Container Name: docker-ssrf_proxy-1

Container ID: 5bb7c4a2317a77f986123e88b87a6d7f9aefc19dbee51aa948c4ee2b6c9bb45f

Image Name: ubuntu/squid:latest

阿里云直接包警告了，需要如何处理下面的警告：
告警原因模型检测到进程访问了可疑的dnslog域名。
数据来源dns域名访问触发检测
域名d3507m1lt95oel1itqk0k17fxedhka9ng.oast.pro
进程ID7513
命令行/usr/sbin/squid -f /etc/squid/squid.conf -NYC 1
进程路径/usr/sbin/squid
父进程ID6166
容器名docker-ssrf_proxy-1
容器ID5bb7c4a2317a77f986123e88b87a6d7f9aefc19dbee51aa948c4ee2b6c9bb45f
镜像IDubuntu/squid@sha256:ae2609ccf37299a5ef588dee92634e6c217933adf2ebe1f12ef8a42eac33c34a
镜像名ubuntu/squid:latest
容器hostname5bb7c4a2317a
容器视角进程路径/proc/4881/root/usr/sbin/squid
进程链-[4858] /usr/bin/containerd-shim-runc-v2 -namespace moby -id 5bb7c4a2317a77f986123e88b87a6d7f9aefc19dbee51aa948c4ee2b6c9bb45f -address /run/containerd/containerd.sock

-[4881]  sh -c cp /docker-entrypoint-mount.sh /docker-entrypoint.sh && sed -i 's/


$//' /docker-entrypoint.sh && chmod +x /docker-entrypoint.sh && /docker-entrypoint.sh

    -[6166]  /bin/bash /docker-entrypoint.sh
Originally created by @leeyisoft on GitHub (Sep 16, 2025). ### Self Checks - [x] I have read the [Contributing Guide](https://github.com/langgenius/dify/blob/main/CONTRIBUTING.md) and [Language Policy](https://github.com/langgenius/dify/issues/1542). - [x] This is only for bug report, if you would like to ask a question, please head to [Discussions](https://github.com/langgenius/dify/discussions/categories/general). - [x] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones. - [x] I confirm that I am using English to submit this report, otherwise it will be closed. - [x] 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：） - [x] Please do not modify this template :) and fill in all the required fields. ### Dify version 1.1.3 and 1.8.1 ### Cloud or Self Hosted Self Hosted (Docker) ### Steps to reproduce ## Description While using the Dify SSRF proxy Docker container, an alert from Alibaba Cloud security detected a suspicious DNSLog access. It appears that the default Squid configuration may have a potential SSRF security risk. For reference, the relevant Squid configuration snippets and the original Alibaba Cloud alert are provided below. --- ## Squid Configuration Snippets (original, unmodified) ### 1) /etc/squid/squid.conf ```conf docker exec -it docker-ssrf_proxy-1 cat /etc/squid/squid.conf acl localnet src 0.0.0.1-0.255.255.255 # RFC 1122 "this" network (LAN) acl localnet src 10.0.0.0/8 # RFC 1918 local private network (LAN) acl localnet src 100.64.0.0/10 # RFC 6598 shared address space (CGN) acl localnet src 169.254.0.0/16 # RFC 3927 link-local (directly plugged) machines acl localnet src 172.16.0.0/12 # RFC 1918 local private network (LAN) acl localnet src 192.168.0.0/16 # RFC 1918 local private network (LAN) acl localnet src fc00::/7 # RFC 4193 local private network range acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines acl SSL_ports port 443 # acl SSL_ports port 1025-65535 # Enable the configuration to resolve this issue: https://github.com/langgenius/dify/issues/12792 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT acl allowed_domains dstdomain .marketplace.dify.ai http_access allow allowed_domains http_access deny !Safe_ports http_access deny CONNECT !SSL_ports http_access allow localhost manager http_access deny manager http_access allow localhost include /etc/squid/conf.d/*.conf http_access deny all ################################## Proxy Server ################################ http_port 3128 coredump_dir /var/spool/squid refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern . 0 20% 4320 # cache_dir ufs /var/spool/squid 100 16 256 # upstream proxy, set to your own upstream proxy IP to avoid SSRF attacks # cache_peer 172.1.1.1 parent 3128 0 no-query no-digest no-netdb-exchange default ################################## Reverse Proxy To Sandbox ################################ http_port 8194 accel vhost cache_peer sandbox parent 8194 0 no-query originserver acl src_all src all http_access allow src_all # Unless the option's size is increased, an error will occur when uploading more than two files. client_request_buffer_max_size 100 MB ```` ### 2) /etc/squid/conf.d/debian.conf ```conf docker exec -it docker-ssrf_proxy-1 cat /etc/squid/conf.d/debian.conf # # Squid configuration settings for Debian # # Logs are managed by logrotate on Debian logfile_rotate 0 # For extra security Debian packages only allow # localhost to use the proxy on new installs # http_access allow localnet ``` ### 3) /etc/squid/conf.d/rock.conf ```conf docker exec -it docker-ssrf_proxy-1 cat /etc/squid/conf.d/rock.conf # Set max_filedescriptors to avoid using system's RLIMIT_NOFILE. See LP: #1978272 max_filedescriptors 1024 ``` ## Environment * Dify SSRF proxy Docker container * Ubuntu / official Squid latest image * Alibaba Cloud ECS + internal VPC --- ### ✔️ Expected Behavior 1. The Squid proxy in the Docker container should only allow internal network access and **not trigger public SSRF alerts**. 2. The reverse proxy (port 8194) should only communicate with the sandbox. 3. Request official confirmation on whether these default configurations have potential SSRF security risks, and guidance for secure configuration. ### ❌ Actual Behavior Alibaba Cloud Alert (original) Reason: Process accessed suspicious DNSLog domain Data Source: DNS domain access triggered detection Domain: d3507m1lt95oel1itqk0k17fxedhka9ng.oast.pro Process ID: 7513 Command: /usr/sbin/squid -f /etc/squid/squid.conf -NYC 1 Process Path: /usr/sbin/squid Parent PID: 6166 Container Name: docker-ssrf_proxy-1 Container ID: 5bb7c4a2317a77f986123e88b87a6d7f9aefc19dbee51aa948c4ee2b6c9bb45f Image Name: ubuntu/squid:latest 阿里云直接包警告了，需要如何处理下面的警告： 告警原因模型检测到进程访问了可疑的dnslog域名。 数据来源dns域名访问触发检测 域名d3507m1lt95oel1itqk0k17fxedhka9ng.oast.pro 进程ID7513 命令行/usr/sbin/squid -f /etc/squid/squid.conf -NYC 1 进程路径/usr/sbin/squid 父进程ID6166 容器名docker-ssrf_proxy-1 容器ID5bb7c4a2317a77f986123e88b87a6d7f9aefc19dbee51aa948c4ee2b6c9bb45f 镜像IDubuntu/squid@sha256:ae2609ccf37299a5ef588dee92634e6c217933adf2ebe1f12ef8a42eac33c34a 镜像名ubuntu/squid:latest 容器hostname5bb7c4a2317a 容器视角进程路径/proc/4881/root/usr/sbin/squid 进程链-[4858] /usr/bin/containerd-shim-runc-v2 -namespace moby -id 5bb7c4a2317a77f986123e88b87a6d7f9aefc19dbee51aa948c4ee2b6c9bb45f -address /run/containerd/containerd.sock -[4881] sh -c cp /docker-entrypoint-mount.sh /docker-entrypoint.sh && sed -i 's/ <br />$//' /docker-entrypoint.sh && chmod +x /docker-entrypoint.sh && /docker-entrypoint.sh -[6166] /bin/bash /docker-entrypoint.sh
yindo closed this issue 2026-02-21 19:36:43 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#17549
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?