| शीर्षक | MegaEase easeprobe easeprobe-v2.3.0 Reliance on IP Address for Authentication |
|---|
| विवरण | An IP spoofing vulnerability exists in the easeprobe project version 2.3.0 and earlier.
easeprobe : A simple, standalone, and lightweight tool that can do health/status checking, written in Go.
The code in line 182 of the web/server.go file in this project uses the middleware.RealIP middleware from go-chi/chi/v5.
The realIP() function in go-chi/chi/[email protected]/middleware/realip.go directly extracts the client IP from HTTP headers (X-Forwarded-For, X-Real-IP, True-Client-IP) without validating whether the request originates from a trusted reverse proxy. Since there is no trusted proxy CIDR check, any client can send these headers to arbitrarily spoof their IP address.
The RemoteAddr field of the incoming HTTP request is overwritten with the attacker-controlled value from these headers. This allows malicious clients to bypass IP-based access controls, evade rate limiting, and pollute audit logs with forged IP addresses.
I demonstrated this vulnerability by sending crafted HTTP headers in a local test environment, which resulted in successful IP spoofing and access log contamination.
I put poc.sh and local_config.yaml files for the malicious reproduction in this directory as well.
|
|---|
| स्रोत | ⚠️ https://github.com/BiBi8BoBo/megaease_easeprobe-unvalidated-X-Forwarded-For-header |
|---|
| उपयोगकर्ता | zozozoe (UID 99362) |
|---|
| सबमिशन | 01/07/2026 07:00 AM (2 महीनों पहले) |
|---|
| संयम | 31/08/2026 07:22 AM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 397232 [MegaEase EaseProbe तक 2.3.0 Middleware web/server.go realIP X-Forwarded-For/X-Real-IP/True-Client-IP अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|