fix: Prevent an App from setting a public address that conflicts with a Teleport Proxy public address 👮🏾

[cthach]

What?

Fixes https://github.com/gravitational/teleport-private/issues/2104.

Changelog: Prevents an application from being registered if its public address matches a Teleport cluster address.

Why?

If an application's public address conflicts with any public addresses of the Teleport cluster, it potentially enables a malicious attacker to perform session hijacking through the misconfigured application.

How?

Adds application public address validation for applications added through Teleport's config and through dynamic means.

It also updates the routing logic to prevent users of existing Teleport instances from routing to any misconfigured applications that existed before this change.

Demo

CLI

When attempting to set an application's public_addr to one that conflicts with the Teleport cluster's proxy address, an error is returned when starting Teleport.

Web UI

If a misconfigured application existed prior to these changes, the Web UI will prevent routing to that misconfigured app and will display an error message with next steps.

[github-actions]

Amplify deployment status

Branch	Commit	Job ID	Status	Preview	Updated (UTC)
cthach/restrict-public-addr	b5e75b5	12	✅SUCCEED	cthach-restrict-public-addr	2025-09-04 19:52:00

[rosstimothy]

I would consider dropping the explanation to keep the message concise and not distract from what is wrong and how to remediate.

Suggested change

	"Application %q public address %q conflicts with the Teleport Proxy public address. "+
	"If both addresses are identical, requests intended for the proxy could be misrouted to the application, "+
	"compromising security. "+
	"Configure the application to use a unique public address that does not match the proxy's public addresses. "+
	"Refer to https://goteleport.com/docs/enroll-resources/application-access/guides/connecting-apps/.",
	"Application %q public address %q conflicts with the Teleport Proxy public address. "+
	"Configure the application to use a unique public address that does not match the proxy's public addresses. "+
	"Refer to https://goteleport.com/docs/enroll-resources/application-access/guides/connecting-apps/.",

[cthach]

Yes, I like that! Pushed in 20b176c

[rosstimothy]

Same suggestion as above.

Suggested change

	"If both addresses are identical, requests intended for the proxy could be misrouted to the application, " +
	"compromising security. " +

[rob-picard-teleport]

nit: grammatically I think you mean "the public address of any proxy" (i.e. each proxy only has one)

[cthach]

(i.e. each proxy only has one)

When I first started this, I assumed exactly that. After looking through the code, I found that Proxy can have more than one 🤯 and it will even start just fine if multiple addresses are set in the public_addr field (e.g. [ "p1.example.com", "p2.example.com"]

Is this a bug or a valid configuration?

[rob-picard-teleport]

Looks like we only return one with GetPublicAddr below. Maybe this could lead to a bypass if I can set multiple, but we're only validating the first, which seems to be how it works:

// GetPublicAddr returns a public address where this server can be reached.
func (s *ServerV2) GetPublicAddr() string {
	addrs := s.GetPublicAddrs()
	if len(addrs) != 0 {
		return addrs[0]
	}
	return ""
}

[cthach]

Interesting. I'm not sure the reasoning behind that, but there is a GetPublicAddrs() that we can use. I'll update to use that instead so we're validating all public addrs.

[cthach]

Done in b5e75b5.

Thoughts?

[rob-picard-teleport]

Looks good to me!

[rob-picard-teleport]

Why is this if statement here, but we log the error to warn admins outside of it?

[cthach]

Great catch! Fixed in 3ffc606

[backport-bot-workflows]

@cthach See the table below for backport results.

Branch	Result
branch/v16	Failed
branch/v17	Failed
branch/v18	Failed