Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Android: Potential security issue: Trying to connect to an unexpected IP #1466

Open
tomturton mannequin opened this issue Jul 17, 2021 · 2 comments
Open

Android: Potential security issue: Trying to connect to an unexpected IP #1466

tomturton mannequin opened this issue Jul 17, 2021 · 2 comments

Comments

@tomturton
Copy link
Mannequin

tomturton mannequin commented Jul 17, 2021

Using the Android app v2.11.0.

I am self-hosting VaultWarden. I am trying to access VW on a local network with a domain registered on my local DNS.
When trying to connect the Android client to my server (both on the same local network), the request is timing out with following error:

vaultwarden.mydomain.net/3.223.115.185 (port 443) from 192.168.1.113 (port 43768)
isConnected failed

I am alarmed by the attempted connection to 3.223.115.185 (seems to be an AWS address).

Steps To Reproduce

  1. At Bitwarden client login page, tap the cog to enter settings
  2. Change the Server URL to local domain.
  3. Tap 'Save'
  4. Tap 'Log in'
  5. Enter VaultWarden credentials and tap 'Log in'

Environment

  • Pixel 5
  • Android 11
  • Bitwarden Client 2.11.0
  • VaultWarden 2.19.0 running in a docker container on a Synology NAS
@SergeantConfused
Copy link

Hi @tomturton,

  1. What is the IP address of your local bitwarden_rs server?
  2. Is this IP address (3.223.115.185) present in your local configuration? Do you have a DNS record pointing to it?
  3. Where do you see this error message on your Android device, exactly?

Thank you in advance,

@tomturton
Copy link
Mannequin Author

tomturton mannequin commented Jul 19, 2021

Hi @SergeantConfused

  1. 192.168.1.104
  2. To my knowledge, no. I certainly haven't manually entered that IP anywhere.
  3. In the Bitwarden mobile client, upon trying to log in to my VaultWarden server/account.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant