Description
Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers connecting over IPv6 can supply arbitrary X-Forwarded-For values to spoof their source IP and bypass authorization provider IP-based access controls.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| tobychui | zoraxy | 3.2.3 – ≤ 3.3.4 | — |
References
- Pull Request #1264 issue-tracking patch
- Patch Commit patch
- https://github.com/tobychui/zoraxy/blob/v3.3.4/src/mod/auth/sso/forward/util.go#L127-L142 technical-description
- https://github.com/tobychui/zoraxy product
- VulnCheck Advisory: Zoraxy 3.2.3 through 3.3.4 Client IP Spoofing via X-Forwarded-For IPv6 third-party-advisory