| عنوان | aaPanel aaPanel Linux Panel v8.22.0 (GitHub commit 4af59b2386e118fc0e4b2ae838dacac992d16b1c, 2026-08-27) Improper Validation of Input Trusted in Security Decision |
|---|
| الوصف | An unauthenticated source-IP spoofing vulnerability exists in aaPanel v8.22.0
(commit 4af59b2). In the Flask before_request hook (BTPanel/__init__.py:640-646),
the panel reads the client-supplied "X-Real-Ip" HTTP header and writes it
directly into request.remote_addr with only syntactic validation
(is_ipv4 / is_ipv6), without verifying that the connection originates from a
trusted reverse proxy. The CDN_PROXY mode is not required for this to take
effect.
Downstream security checks read that spoofed value via GetClientIp()
(class/public/common.py:1125):
- IP access control / allowlist: check_ip_panel() (common.py:3598) compares
request.remote_addr against data/limitip.conf. An attacker whose real IP is
NOT allowed simply sends "X-Real-Ip: <an-allowed-IP>" and is accepted as if
their connection originated from an allowed address.
- Login anti-bruteforce: limit_address() (class/userlogin.py:398) keys the
5-attempts/300s counter on GetClientIp(). By rotating the spoofed header
value on each attempt, an attacker renders the counter useless and can
brute-force the panel password without any rate limiting.
PoC:
curl -sk -H "X-Real-Ip: 192.168.1.50" https://<host>:8888/login
(real socket x.x.x.x is accepted as the allowlisted IP)
-> rotate the header value to bypass the 5-tries/300s brute-force counter.
Impact: bypass of the panel IP allowlist and unlimited brute-force of the
panel admin password / API-key limit (common.py:355-400) from any remote host.
CVSS 3.1 (est.): CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 High).
Vendor was contacted ([email protected]) on 2026-09-23. No CVE assigned yet,
no submission to another CNA. |
|---|
| المصدر | ⚠️ https://github.com/JdExploit/aapanel-cve-2026/tree/master/aapanel-xrealip |
|---|
| المستخدم | jdexploit (UID 100293) |
|---|
| ارسال | 23/09/2026 10:01 PM (1 شهر منذ) |
|---|
| الاعتدال | 20/10/2026 12:53 PM (27 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 422749 [aaPanel حتى 8.25.0 class/public/common.py GetClientIp X-Real-Ip تجاوز الصلاحيات] |
|---|
| النقاط | 20 |
|---|