Gophish Rate Limit Bypass via Spoofed Headers

Executive Summary

This vulnerability is a rate limit bypass in Gophish versions up to 0.12.1. It allows unauthenticated attackers to evade login throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers send a different forwarded address per request, preventing the rate limiter from triggering since it relies on the rewritten RemoteAddr. This enables unlimited password guessing and credential stuffing attempts.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for unusual login attempts with varying X-Forwarded-For or X-Real-IP headers. Check Gophish logs for repeated failed login attempts from the same source IP but with different forwarded headers. Use network traffic analysis tools like tcpdump or Wireshark to inspect HTTP headers for spoofed IP addresses in requests.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to bypass login rate limits, enabling unlimited attempts for password guessing and credential stuffing. This increases the risk of unauthorized account access, data breaches, and potential compromise of sensitive information stored in Gophish.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could undermine compliance with GDPR and HIPAA by enabling unauthorized access through credential stuffing attacks. Weak rate limiting allows attackers to bypass authentication protections, potentially exposing sensitive user data handled by Gophish in phishing simulations. This violates principles of data protection and access control required by these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Gophish to a version that patches this vulnerability. If upgrading is not possible, implement network-level rate limiting or a Web Application Firewall (WAF) to block requests with spoofed headers. Disable or restrict access to the login endpoint until mitigation is complete.

Useful 0 Not Useful 0