关键漏洞信息 漏洞名称 Remote Header Injection via X-Forwarded-For Manipulation 影响的包 Package: fastapi (Python (FastAPI)) 影响版本与修复版本 Affected versions: All versions that trust the X-Forwarded-For header without validation. Patched versions: 2.0.0 描述 An HTTP header injection vulnerability has been identified in the FastAPI application. By manipulating the X-Forwarded-For header, an attacker can potentially inject arbitrary IP addresses into the request, which may lead to bypassing security measures that rely on IP-based access controls or logging. 漏洞详情 The vulnerability lies in the FastAPI application's handling of the X-Forwarded-For header. The X-Forwarded-For header is often used by reverse proxies to identify the original IP address of a client making a request. However, since it is a header sent by the client, it is possible to manipulate it and inject arbitrary IP addresses into the request. This could lead to false attribution of the client IP address, allowing attackers to bypass IP-based security mechanisms or mislead logging systems. 示例代码片段 PoC步骤 1. Run the FastAPI application locally: 2. Send a crafted request with a manipulated X-Forwarded-For header: 影响 This vulnerability can allow attackers to bypass IP-based access controls, mislead logging systems, and impersonate trusted clients. It is especially impactful when the application relies on the X-Forwarded-For header for IP-based authorization or authentication. 严重性 Severity: Low (3.4 / 10) CVSS v3 base metrics: - Attack vector: Network - Attack complexity: High - Privileges required: None - User interaction: Required - Scope: Changed - Confidentiality: Low - Integrity: None - Availability: None CVE ID: CVE-2025-46814