Submit #996821: aaPanel aaPanel Linux Panel v8.22.0 (GitHub commit 4af59b2386e118fc0e4b2ae838dacac992d16b1c, 2026-08-27) Improper Validation of Input Trusted in Security Decision

An unauthenticated source-IP spoofing vulnerability exists in aaPanel v8.22.0
(commit 4af59b2). In the Flask before_request hook (BTPanel/__init__.py:640-646),
the panel reads the client-supplied "X-Real-Ip" HTTP header and writes it
directly into request.remote_addr with only syntactic validation
(is_ipv4 / is_ipv6), without verifying that the connection originates from a
trusted reverse proxy. The CDN_PROXY mode is not required for this to take
effect.

Downstream security checks read that spoofed value via GetClientIp()
(class/public/common.py:1125):

- IP access control / allowlist: check_ip_panel() (common.py:3598) compares
request.remote_addr against data/limitip.conf. An attacker whose real IP is
NOT allowed simply sends "X-Real-Ip: <an-allowed-IP>" and is accepted as if
their connection originated from an allowed address.

- Login anti-bruteforce: limit_address() (class/userlogin.py:398) keys the
5-attempts/300s counter on GetClientIp(). By rotating the spoofed header
value on each attempt, an attacker renders the counter useless and can
brute-force the panel password without any rate limiting.

PoC:
curl -sk -H "X-Real-Ip: 192.168.1.50" https://<host>:8888/login
(real socket x.x.x.x is accepted as the allowlisted IP)
-> rotate the header value to bypass the 5-tries/300s brute-force counter.

Impact: bypass of the panel IP allowlist and unlimited brute-force of the
panel admin password / API-key limit (common.py:355-400) from any remote host.

CVSS 3.1 (est.): CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 High).
Vendor was contacted ([email protected]) on 2026-09-23. No CVE assigned yet,
no submission to another CNA.

• Source: ⚠️ https://github.com/JdExploit/aapanel-cve-2026/tree/master/aapanel-xrealip
• User: jdexploit (UID 100293)
• Submission: 09/23/2026 22:01 (1 month ago)
• Moderation: 10/20/2026 12:53 (27 days later)
• Status: Accepted
• VulDB entry: 422749 [aaPanel up to 8.25.0 class/public/common.py GetClientIp X-Real-Ip access control]
• Points: 20