Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address, undermining IP-based access controls, rate limiting, audit logging, or geographic restrictions that trust Echo's forwarded identity. This issue is fixed in Echo 5.4.0.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…k/echo/security/advisories/GHSA-99jh-6h7p-pp36 Diğer
• github.com/…ommit/fc410094b2f3415cf2bf5204082137b205bfd5af Diğer
• github.com/labstack/echo/releases/tag/v5.4.0 Diğer

Kayıt geçmişi

1. 28 Eki 2026 22:30Yayımlandı

İlgili açıklar

• 5,3 CVE-2026-118653Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration
• 6,1 CVE-2026-118652Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob
• 7,5 CVE-2026-118650Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path
• 5,3 CVE-2026-118266Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method
• 5,3 CVE-2026-118265Echo: X-Real-IP extractor trusts the header value instead of the sending peer
• 9,1 CVE-2026-118264Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls