DeepSeek Harness Vulnerability and Self‑Hosting Guide for shell.online

说明与用途

DeepSeek Harness 存在 Host 头部信任漏洞，导致沙箱逃逸。shell.online 现在提供自托管指南，将服务拆分为 Cloudflare Workers 中继和可选账户应用。关键设置是 TRUST_PROXY=0，除非在受信任代理后方，否则不信任 X‑Forwarded‑For。

问题

DeepSeek Harness allowed sandbox escape via Host header trust flaw, exposing unconfined agent commands.

结果

Users can now safely self‑host shell.online, avoiding the DeepSeek Harness vulnerability and correctly configuring header trust.

工作流

• 1. Clone shell.online repo. 2. Deploy relay: copy wrangler.example.jsonc to wrangler.local.jsonc, run wrangler deploy. 3. Point CLI to relay with shell --server https://example.workers.dev or SHELL_ONLINE_SERVER. 4. For accounts app, run docker compose up --build -d in app/. 5. Configure RELAY_URL, SHELL_ONLINE_ACCOUNTS, SHELL_ONLINE_WEB. 6. Set TRUST_PROXY=0 in .env.example unless behind trusted proxy. 7. Verify rate limiting uses CF-Connecting-IP and headers are ignored unless proxy trusted.

证据

The harness hands the agent's shell the address of its own local API and the current session id. So the escape was one curl from inside the sandbox to the harness's session-update endpoint, with a Host header of 127.0.0.1

来源

The guide splits shell.online into two services. The relay serves the public site and carries encrypted terminal frames. The accounts app in app/ is optional, adds sign-in, organizations, linked machines and the shared session list, and the CLI does not need it.

来源

TRUST_PROXY=0 is the line to get right before the app is reachable from anywhere but localhost.

来源