| タイトル | MegaEase easeprobe easeprobe-v2.3.0 Reliance on IP Address for Authentication |
|---|
| 説明 | An IP spoofing vulnerability exists in the easeprobe project version 2.3.0 and earlier.
easeprobe : A simple, standalone, and lightweight tool that can do health/status checking, written in Go.
The code in line 182 of the web/server.go file in this project uses the middleware.RealIP middleware from go-chi/chi/v5.
The realIP() function in go-chi/chi/[email protected]/middleware/realip.go directly extracts the client IP from HTTP headers (X-Forwarded-For, X-Real-IP, True-Client-IP) without validating whether the request originates from a trusted reverse proxy. Since there is no trusted proxy CIDR check, any client can send these headers to arbitrarily spoof their IP address.
The RemoteAddr field of the incoming HTTP request is overwritten with the attacker-controlled value from these headers. This allows malicious clients to bypass IP-based access controls, evade rate limiting, and pollute audit logs with forged IP addresses.
I demonstrated this vulnerability by sending crafted HTTP headers in a local test environment, which resulted in successful IP spoofing and access log contamination.
I put poc.sh and local_config.yaml files for the malicious reproduction in this directory as well.
|
|---|
| ソース | ⚠️ https://github.com/BiBi8BoBo/megaease_easeprobe-unvalidated-X-Forwarded-For-header |
|---|
| ユーザー | zozozoe (UID 99362) |
|---|
| 送信 | 2026年07月01日 07:00 (2 月 ago) |
|---|
| モデレーション | 2026年08月31日 07:22 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 397232 [MegaEase EaseProbe 迄 2.3.0 Middleware web/server.go realIP X-Forwarded-For/X-Real-IP/True-Client-IP 特権昇格] |
|---|
| ポイント | 20 |
|---|