Origin Validation Bypass in rathena FluxCP via X-Real-IP Header

Executive Summary

This vulnerability affects FluxCP, a PHP framework used with rAthena, specifically in its PayPal IPN handler. It allows unauthenticated attackers to forge payment notifications by exploiting improper IP address validation. The flaw relies on spoofable headers like X-Real-IP instead of the server's REMOTE_ADDR, enabling attackers to bypass PayPal verification and manipulate payment data.

Useful 0 Not Useful 0

Detection Guidance

Check for unusual POST requests to the PayPal IPN handler endpoint with spoofed X-Real-IP or X-Forwarded-For headers. Monitor for base64-encoded parameters in requests targeting lib/Flux/PaymentNotifyRequest.php. Look for repeated requests with CIDR ranges like 173.0.81.0/24.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to mint arbitrary credits into any player account or permanently ban accounts by manipulating payment statuses. This could disrupt the game's economy, grant unauthorized in-game advantages, or lock players out of their accounts. Exploitation requires no prerequisites beyond default settings.

Useful 0 Not Useful 0

Mitigation Strategies

Disable reliance on X-Real-IP/X-Forwarded-For headers for IP validation. Enforce PayPal verification on all code paths. Implement transaction idempotency with server-side persistence. Avoid unsafe deserialization of untrusted input. Use a trusted reverse proxy to strip spoofable headers.

Useful 0 Not Useful 0