Password Spoofing in Password Pusher via X-Forwarded-For

Executive Summary

Password Pusher versions 1.49.0 to 2.16.2 have an IP spoofing flaw due to unanchored trusted-proxy regular expressions. Attackers can manipulate X-Forwarded-For headers to forge their IP address in audit logs and bypass rate limits. The issue occurs because the regex for private IP ranges (10.0.0.0/8) incorrectly matches public ranges like 110.0.0.0/8 or 210.0.0.0/8.

Useful 0 Not Useful 0

Detection Guidance

Check Password Pusher logs for suspicious IP addresses in the 110.0.0.0/8 or 210.0.0.0/8 ranges. Inspect X-Forwarded-For headers in HTTP requests for forged values. Use network monitoring tools to detect unusual rate limiting bypass attempts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to falsify their IP address in logs, making it appear as if actions were performed by another user or system. It can also bypass password generator rate limits, potentially enabling brute-force attacks. Affected systems may log incorrect IP addresses, complicating forensic analysis and audit trails.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could undermine compliance by allowing false IP attribution in logs, which may violate data integrity requirements in GDPR and HIPAA. Incorrect audit logs may fail to meet regulatory standards for accurate record-keeping and accountability.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Password Pusher to version 2.17.0 or later. Review and update trusted-proxy configurations to use proper IPAddr ranges. Validate X-Forwarded-For headers to ensure they match expected proxy ranges.

Useful 0 Not Useful 0