Helmholtz IP Spoofing via Unvalidated Forwarding Headers (CWE-287) Advisory

Vulnerability Summary: IP Spoofing via Unvalidated Forwarding Headers Vulnerability Overview When the option is configured, Helmholtz trusts the client IP address provided by the upstream (e.g., via headers). In proxy mode, Helmholtz extracts the client IP address and validates its legitimacy (e.g., ensuring it is not a private address, multicast address, or reserved address per RFC 1918 and RFC 7229). If the option is not configured, Helmholtz ignores the client IP address and always uses as the client IP address. Scope of Impact Affected Versions: 0.17.16 and earlier Fixed Versions: 0.17.17 and later CVSS Score: 7.0 (High) CWE ID: CWE-287 (Improper Authentication) Mitigation 1. Ensure only trusted servers can communicate within the network: Configure firewalls or network policies to restrict communication with Helmholtz to only trusted servers. 2. Configure the option: If the upstream server is trusted, configure the option to allow it to forward the client IP address. 3. Enable the option in proxy mode: In proxy mode, enable the option to validate the client IP address. 4. Enable the option in the configuration: Enable the option within the configuration to validate the client IP address. Attack Scenarios Scenario 1: Bypassing Rate Limiting Attackers can bypass rate limiting by spoofing the client IP address. For example, an attacker can spoof an IP address from a trusted proxy server to circumvent rate limits. Scenario 2: Bypassing Access Control Based on Client IP In proxy mode, a spoofed client IP address can bypass access control mechanisms based on client IP. For example, an attacker can spoof an IP address from a trusted proxy server to bypass access controls. Scenario 3: Unauthorized Client IP Address Queries via Embedded Content If the frontend contains embedded content displaying the client IP address (e.g., within a tag), it may lead to unauthorized queries of client IP addresses. Workaround Ensure only trusted servers can communicate within the network: Configure firewalls or network policies to restrict communication with Helmholtz to only trusted servers. Configure the option: If the upstream server is trusted, configure the option to allow it to forward the client IP address. Enable the option in proxy mode: In proxy mode, enable the option to validate the client IP address. Enable the option in the configuration: Enable the option within the configuration to validate the client IP address. Remediation Timeline 2024-07-01: Vulnerability reported 2024-07-02: Vulnerability confirmed 2024-07-03: Vulnerability fixed Fixed Version 0.17.17: Fixed version Fix Details Fix Description: Resolved the client IP address validation issue when the option was not configured. Fix Method: When the option is not configured, Helmholtz now ignores the client IP address and always uses as the client IP address. Recommendations Upgrade: Users are advised to upgrade to version 0.17.17 or higher. Configure the option: If the upstream server is trusted, configure the option to allow it to forward the client IP address. Enable the option in proxy mode: In proxy mode, enable the option to validate the client IP address. Enable the option in the configuration: Enable the option within the configuration to validate the client IP address.

Goal Reached Thanks to every supporter — we hit 100%!

Helmholtz IP Spoofing via Unvalidated Forwarding Headers (CWE-287) Advisory

More from this source