aaPanel IP-Bypass via X-Real-Ip Header

Executive Summary

This vulnerability affects aaPanel up to version 8.25.0. It involves improper access controls due to manipulation of the X-Real-Ip HTTP header in the GetClientIp function of class/public/common.py. Attackers can spoof their IP address by setting this header to bypass security measures like IP allowlists and brute-force protections.

Useful 0 Not Useful 0

Detection Guidance

Check aaPanel logs for unusual IP addresses in requests, particularly those containing the X-Real-Ip header. Inspect network traffic for repeated requests with varying X-Real-Ip values to detect brute-force attempts. Use tools like curl to test if the application trusts the X-Real-Ip header by sending requests with spoofed IPs and observing responses.

Useful 0 Not Useful 0

Impact Analysis

An attacker could bypass IP restrictions by spoofing an allowed IP in the X-Real-Ip header. They could also evade login brute-force protections by rotating this header. This may allow unauthorized access to sensitive functions or data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade aaPanel to version 8.25.0 or later, as the vendor confirms the vulnerability has been fixed. If upgrading is not immediately possible, configure your reverse proxy to only forward requests from trusted proxies and avoid overwriting REMOTE_ADDR from headers. Disable IP-based access controls and brute-force protections until the update is applied.

Useful 0 Not Useful 0