API access broken on v280.1.11 on using hostname. Host header blocked.

[renelehmann]

After an update to bosh v280.1.11, login to the bosh-director is not possible on using the hostname.

With calling the director API /info endpoint on using the hostname url it shows the same error:
curl https://bosh-bosh.service.consul:25555/info
Host not permitted

On the bosh vm itself all monit jobs are running in a healthy state and a local curl to the API
is accepted and looks fine:

bosh/65ff9923-5195-4335-99a0-30ee807588b3:~# curl -k https://localhost:25555/info
{"name":"bosh-bosh","uuid":"2413ef39-947a-47f9-b16b-d61c4e5ed8c5","version":"280.1.11 (00000000)","user":null,"cpi":"vsphere_cpi","stemcell_os":"-","stemcell_version":"1.639","user_authentication":{"type":"uaa","options":{"url":"https://bosh-bosh.service.consul:8443/","urls":["https://bosh-bosh.service.consul:8443/"]}},"features":{"local_dns":{"status":true,"extras":{"domain_name":"bosh"}},"snapshots":{"status":false},"config_server":{"status":true,"extras":{"urls":["https://bosh-bosh.service.consul:8844/api/"]}}}}

Also calling the endpoint on using the bosh VM IP is succesful.
curl https://1.2.3.4:25555/info

Comparing to bosh v280.1.10, the behaviour with the same call on using the hostname is successful:

curl https://bosh-bosh.service.consul:25555/info
{"name":"bosh-bosh","uuid":"2413ef39-947a-47f9-b16b-d61c4e5ed8c5","version":"280.1.10 (00000000)","user":null,"cpi":"vsphere_cpi","stemcell_os":"-","stemcell_version":"1.639","user_authentication":{"type":"uaa","options":{"url":"https://bosh-bosh.service.consul:8443/","urls":["https://bosh-bosh.service.consul:8443/"]}},"features":{"local_dns":{"status":true,"extras":{"domain_name":"bosh"}},"snapshots":{"status":false},"config_server":{"status":true,"extras":{"urls":["https://bosh-bosh.service.consul:8844/api/"]}}}}

This issue was discussed on slack:

https://cloudfoundry.slack.com/archives/C02HPPYQ2/p1732707019069449

Initial investigations show the cause in the Sinatra version used, which was fixed for a CVE.

[rajathagasthya]

We added a fix for this in f853c0b. This should allow hostnames again.

[selzoc]

@renelehmann we believe this is fixed as of https://github.com/cloudfoundry/bosh/releases/tag/v280.1.12, can you verify?

Thanks,
Chris

[renelehmann]

@rajathagasthya, @selzoc Thanks for fixing, implementing and the notification.
Tested v280.1.12 and all just works fine again.