Unrecognised IPs Found in the Docker Container

[shihab-geo]

Hello,

I ran the docker image "bbernhard/signal-cli-rest-api". While requesting any API request, I found the below IPs in the docker logs continuously
172.17.0.1 103.219.114.211 45.248.151.49 45.248.151.50

As I know '172.17.0.1' is a common internal Docker network IP address. The rest of the IPs are public or external IPs.

It would be helpful to let me know what the functions of the public IPs are. And are there any security issues?

Thanks

[bbernhard]

Where do you see them exactly? Have you maybe accidentally exposed the REST API on a public ip?

[shihab-geo]

The IP is Private. The REST API is not exposed in Public.

[bbernhard]

Ok, because before you mentioned it was exposed to the public domain.

Could you maybe post the part of the log file where you see them.

[shihab-geo]

`

• hostname -I
• awk {print $1}
• export HOST_IP=172.17.0.2
• exec setpriv --reuid=1000 --regid=1000 --init-groups --inh-caps=-cap_0,-cap_1,-cap_2,-cap_3,-cap_4,-cap_5,-cap_6,-cap_7,-cap_8,-cap_9,-cap_10,-cap_11,-cap_12,-cap_13,-cap_14,-cap_15,-cap_16,-cap_17,-cap_18,-cap_19,-cap_20,-cap_21,-cap_22,-cap_23,-cap_24,-cap_25,-cap_26,-cap_27,-cap_28,-cap_29,-cap_30,-cap_31,-cap_32,-cap_33,-cap_34,-cap_35,-cap_36,-cap_37 signal-cli-rest-api -signal-cli-config=/home/.local/share/signal-cli
  time="2024-08-18T17:27:57Z" level=info msg="Started Signal Messenger REST API"
  time="2024-08-18T17:28:13Z" level=info msg="INFO AccountHelper - The Signal protocol expects that incoming messages are regularly received."
  [GIN] 2024/08/18 - 17:28:13 | 200 | 6.022371483s | 45.248.151.49 | GET "/v1/groups/+000"
  time="2024-08-18T17:28:45Z" level=info msg="INFO AccountHelper - The Signal protocol expects that incoming messages are regularly received."
  [GIN] 2024/08/18 - 17:28:45 | 200 | 5.147153217s | 45.248.151.49 | GET "/v1/groups/+000"
  time="2024-08-18T17:30:24Z" level=info msg="INFO AccountHelper - The Signal protocol expects that incoming messages are regularly received."
  time="2024-08-18T17:30:30Z" level=info msg="INFO AccountHelper - The Signal protocol expects that incoming messages are regularly received."
  [GIN] 2024/08/18 - 17:30:30 | 204 | 12.885260783s | 45.248.151.49 | DELETE "/v1/groups/+000/group.VU1PQVlWU3NkRmFNVDVRCbFlSUERMekFDekpmQS9rUzltWnA4Yz0=/members"
  time="2024-08-18T17:30:55Z" level=info msg="INFO AccountHelper - The Signal protocol expects that incoming messages are regularly received."
  [GIN] 2024/08/18 - 17:30:55 | 200 | 5.724786413s | 45.248.151.49 | GET "/v1/groups/+000"
  time="2024-08-18T17:31:38Z" level=info msg="INFO AccountHelper - The Signal protocol expects that incoming messages are regularly received."
  time="2024-08-18T17:31:46Z" level=info msg="INFO AccountHelper - The Signal protocol expects that incoming messages are regularly received."
  [GIN] 2024/08/18 - 17:31:46 | 204 | 13.723178116s | 45.248.151.49 | POST "/v1/groups/+000/group.235345=/members"
  time="2024-08-18T17:32:20Z" level=info msg="INFO AccountHelper - The Signal protocol expects that incoming messages are regularly received."
  [GIN] 2024/08/18 - 17:32:20 | 201 | 7.325736129s | 45.248.151.49 | POST "/v2/send"
  time="2024-08-18T17:38:01Z" level=info msg="INFO AccountHelper - The Signal protocol expects that incoming messages are regularly received."
  time="2024-08-18T17:38:08Z" level=info msg="INFO AccountHelper - The Signal protocol expects that incoming messages are regularly received."
  [GIN] 2024/08/18 - 17:38:08 | 204 | 13.409243286s | 45.248.151.50 | POST "/v1/groups/+000/group.VU1VDVJQU1BWkRCbFlSUERMekFDekpmQS9rUzltWnA4Yz0=/admins"
  time="2024-08-18T17:38:58Z" level=info msg="INFO AccountHelper - The Signal protocol expects that incoming messages are regularly received."
  [GIN] 2024/08/18 - 17:38:58 | 200 | 5.86384321s | 45.248.151.50 | GET "/v1/groups/+000"
  time="2024-08-18T17:39:27Z" level=info msg="INFO AccountHelper - The Signal protocol expects that incoming messages are regularly received."
  [GIN] 2024/08/18 - 17:39:27 | 201 | 7.505967662s | 45.248.151.50 | POST "/v2/send"
  time="2024-08-18T17:41:30Z" level=info msg="INFO AccountHelper - The Signal protocol expects that incoming messages are regularly received."
  [GIN] 2024/08/18 - 17:41:35 | 400 | 11.168549907s | 45.248.151.50 | POST "/v1/groups/+000/group.VU1PQVlU1BWkRCbFlSUERMekFDekpmQS9rUzltWnA4Yz0=/admins"
  time="2024-08-18T17:42:07Z" level=info msg="INFO AccountHelper - The Signal protocol expects that incoming messages are regularly received."
  time="2024-08-18T17:42:13Z" level=info msg="INFO AccountHelper - The Signal protocol expects that incoming messages are regularly received."
  [GIN] 2024/08/18 - 17:42:13 | 204 | 12.653184019s | 45.248.151.50 | POST "/v1/groups/+000/group.VU1PQVlWU3NkRmU1BWkRCbFlSUERMekFDekpmQS9rUzltWnA4Yz0=/admins"
  `

[bbernhard]

I did a geo source lookup of IPs ips you mentioned in the first post. All of those IPs are from Bangladesh. Are you really sure that a.) those are not your public ips and b.) you haven't exposed the REST API on a public interface?

This project only uses and connects to the official Signal Servers, so there must be something in your setup.