quickFix: invalid config in "Feat(nginx): Add support for IPv6"

[kiblik]

This reverts commit e9d9872.

[dryrunsecurity]

This pull request introduces two security vulnerabilities in the Nginx configuration: it removes HTTPS redirection, potentially exposing unencrypted traffic, and eliminates the server_name directive, which could enable host header injection and improper request routing.

Insecure Communication (Missing HTTPS Redirection) in nginx/nginx_TLS.conf

Vulnerability	Insecure Communication (Missing HTTPS Redirection)
Description	The return 301 https://$host:8443$request_uri; directive, which previously enforced HTTP to HTTPS redirection for traffic on port 8080, has been removed from the nginx_TLS.conf file. This allows unencrypted HTTP communication to the server, potentially exposing sensitive data to eavesdropping or man-in-the-middle attacks.

django-DefectDojo/nginx/nginx_TLS.conf

Lines 20 to 25 in 0466075

	}
	server {
	listen 8080;
	location / {
	return 301 https://$host:8443$request_uri;
	}

Host Header Injection / Misconfiguration in nginx/nginx_TLS.conf

Vulnerability

Host Header Injection / Misconfiguration

Description

The removal of the server_name directive from the SSL server block on port 8443 in nginx_TLS.conf causes this server block to become the default server for any request to that IP address and port that does not match another specific server_name. This is a misconfiguration that can lead to Host Header Injection if the backend application relies on the Host header for security-sensitive operations (e.g., generating URLs for password resets, redirects, or session management). It could also lead to requests intended for other virtual hosts being incorrectly routed to this one, potentially bypassing security controls tied to specific server_name directives.

django-DefectDojo/nginx/nginx_TLS.conf

Lines 32 to 37 in 0466075

	server {
	server_tokens off;
	listen 8443 ssl;
	server_name your.servername.com;
	ssl_certificate /etc/nginx/ssl/nginx.crt;
	ssl_certificate_key /etc/nginx/ssl/nginx.key;

---

All finding details can be found in the DryRun Security Dashboard.

[mtesauro]

Approved