Finding: pprof plugin can expose profiling remotely #3850

What version of V2Ray are you using?

5.54.2

What's your scenario of using V2Ray?

securing connection

What problems have you encountered?

Location

main/plugins/plugin_pprof/plugin_pprof.go

if *addr != "" {
    ...
    return (&http.Server{
        Addr:*addr,
        Handler:h,
    }).ListenAndServe()
}

The command line option:

--pprof <address>

allows arbitrary binding.

Example:

v2ray run --pprof 0.0.0.0:6060

creates an unauthenticated profiling service.

PoC

Run:

v2ray run --pprof 0.0.0.0:6060

Remote:

curl http://server-ip:6060/debug/pprof/

No authentication is required.

Fix

Require explicit warning:

Example:

WARNING:
pprof is enabled on a non-loopback address.
Continue? [y/N]

or reject:

if !isLoopback(addr) {
    return errors.New(
      "pprof must bind to localhost"
    )
}

What's your expectation?

See above.

Please attach your configuration here

Server configuration:

// Please attach your server configuration here.

Client configuration:

// Please attach your client configuration here.

Please attach error logs here

Server error log:

// Please attach your server error log here.

Client error log:

// Please attach your client error log here.

Please attach access log here

// Please attach your server access log here.

Other configurations (such as Nginx) and logs here

If V2Ray cannot start up, please attach output from --test command

If V2Ray service is abnormal, please attach journal log here