node --inspect=0.0.0.0 - What are the security implications?

94 views Asked by At

I'm reading https://nodejs.org/en/docs/guides/debugging-getting-started

"If the debugger is bound to a public IP address, or to 0.0.0.0, any clients that can reach your IP address will be able to connect to the debugger without any restriction".

Obviously, this is a problem because someone will be able to execute on your host (remote code execution attack).

Now, I looked up what 0.0.0.0 means, and I see "In context of servers, 0.0.0.0 means all IPv4 addresses on the local machine. If a host has two IP addresses, 192.168.1.1 and 10.1.2.1 and a server running on the host listens on 0.0.0.0, it will be reachable at both of those IPs"

In the above example, both 192.168.1.1 and 10.1.2.1 are private IP addresses. But obviously if I'm connected to the internet, I have a public IP address too. Say it is 172.103.243.22. I.e, if the server is listening on 0.0.0.0, will it be reachable at 172.103.243.22? And if the debugger is bound to 0.0.0.0, does that mean that anyone that can reach 172.103.243.22 will be able to connect to the debugger?

0

There are 0 answers