Wrong CIDR in navidrome configuration
Hello, i just doing some research and going around public nixos navidrome configurations. Just noticed strange CIDR declaration in ReverseProxyWhiteList, it may be a possible vulnerability.
https://github.com/kurnevsky/nixfiles/blob/e2ee8c01c5f97aa0e72bdbcd3ce83d13217e4ada/modules/server/navidrome.nix#L7
If you want to allow only localhost, i think there is a more proper way to do that: `ReverseProxyWhiteList = "::1/128,127.0.0.1/32";`
关闭于 2025-11-13 1 条评论