| عنوان | MegaEase easeprobe easeprobe-v2.3.0 Reliance on IP Address for Authentication |
|---|
| الوصف | An IP spoofing vulnerability exists in the easeprobe project version 2.3.0 and earlier.
easeprobe : A simple, standalone, and lightweight tool that can do health/status checking, written in Go.
The code in line 182 of the web/server.go file in this project uses the middleware.RealIP middleware from go-chi/chi/v5.
The realIP() function in go-chi/chi/[email protected]/middleware/realip.go directly extracts the client IP from HTTP headers (X-Forwarded-For, X-Real-IP, True-Client-IP) without validating whether the request originates from a trusted reverse proxy. Since there is no trusted proxy CIDR check, any client can send these headers to arbitrarily spoof their IP address.
The RemoteAddr field of the incoming HTTP request is overwritten with the attacker-controlled value from these headers. This allows malicious clients to bypass IP-based access controls, evade rate limiting, and pollute audit logs with forged IP addresses.
I demonstrated this vulnerability by sending crafted HTTP headers in a local test environment, which resulted in successful IP spoofing and access log contamination.
I put poc.sh and local_config.yaml files for the malicious reproduction in this directory as well.
|
|---|
| المصدر | ⚠️ https://github.com/BiBi8BoBo/megaease_easeprobe-unvalidated-X-Forwarded-For-header |
|---|
| المستخدم | zozozoe (UID 99362) |
|---|
| ارسال | 01/07/2026 07:00 AM (2 أشهر منذ) |
|---|
| الاعتدال | 31/08/2026 07:22 AM (2 months later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 397232 [MegaEase EaseProbe حتى 2.3.0 Middleware web/server.go realIP X-Forwarded-For/X-Real-IP/True-Client-IP تجاوز الصلاحيات] |
|---|
| النقاط | 20 |
|---|