| 제목 | MegaEase easeprobe easeprobe-v2.3.0 Reliance on IP Address for Authentication |
|---|
| 설명 | An IP spoofing vulnerability exists in the easeprobe project version 2.3.0 and earlier.
easeprobe : A simple, standalone, and lightweight tool that can do health/status checking, written in Go.
The code in line 182 of the web/server.go file in this project uses the middleware.RealIP middleware from go-chi/chi/v5.
The realIP() function in go-chi/chi/[email protected]/middleware/realip.go directly extracts the client IP from HTTP headers (X-Forwarded-For, X-Real-IP, True-Client-IP) without validating whether the request originates from a trusted reverse proxy. Since there is no trusted proxy CIDR check, any client can send these headers to arbitrarily spoof their IP address.
The RemoteAddr field of the incoming HTTP request is overwritten with the attacker-controlled value from these headers. This allows malicious clients to bypass IP-based access controls, evade rate limiting, and pollute audit logs with forged IP addresses.
I demonstrated this vulnerability by sending crafted HTTP headers in a local test environment, which resulted in successful IP spoofing and access log contamination.
I put poc.sh and local_config.yaml files for the malicious reproduction in this directory as well.
|
|---|
| 원천 | ⚠️ https://github.com/BiBi8BoBo/megaease_easeprobe-unvalidated-X-Forwarded-For-header |
|---|
| 사용자 | zozozoe (UID 99362) |
|---|
| 제출 | 2026. 07. 01. AM 07:00 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 08. 31. AM 07:22 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 397232 [MegaEase EaseProbe 까지 2.3.0 Middleware web/server.go realIP X-Forwarded-For/X-Real-IP/True-Client-IP 권한 상승] |
|---|
| 포인트들 | 20 |
|---|