GAO EPDS and CBCA EDS X-Forwarded-For Header Bypass

Executive Summary

This vulnerability exists in the U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and the Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS). It occurs because these systems do not validate the X-Forwarded-For HTTP headers.

As a result, a remote attacker who has compromised administrator credentials can exploit this flaw to bypass network access controls and log into the system.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an attacker with compromised administrator credentials to bypass network access controls and gain unauthorized access to the affected systems.

This unauthorized access could lead to potential exposure or manipulation of sensitive information managed by the Electronic Protest Docketing System and the Civilian Board of Contract Appeals Electronic Docketing System.

Useful 0 Not Useful 0