GHSA-786w-p5pm-cvgh: High severity composer/phpsysinfo/phpsysinfo vulnerability

Summary phpSysInfo's PSIALLOWED IP allowlist can be trivially bypassed by any unauthenticated remote attacker. The access-control check in readconfig.php derives the client IP from the attacker-controlled X-Forwarded-For and Client-IP HTTP headers before falling back to REMOTEADDR. An attacker can send X-Forwarded-For: <an allowed IP> to impersonate a trusted address and gain full access to all exposed system information, defeating the only IP-based access restriction the application provides.

Affected component - File: readconfig.php - Versions: all versions up to and including 3.4.x (current main)

Description When PSIALLOWED is configured, readconfig.php enforces an IP allowlist. The client IP is resolved as follows:

php if (isset($SERVER["HTTPXFORWARDEDFOR"])) { $ip = $SERVER["HTTPXFORWARDEDFOR"]; } else { if (isset($SERVER["HTTPCLIENTIP"])) { $ip = $SERVER["HTTPCLIENTIP"]; } else { $ip = $SERVER["REMOTEADDR"]; } }

Both HTTPXFORWARDEDFOR and HTTPCLIENTIP are fully attacker-controlled request headers. They are trusted unconditionally and take priority over REMOTEADDR. There is no concept of a configured/trusted reverse proxy, so even when phpSysInfo is exposed directly (no proxy in front), the spoofed header wins. As a result the allowlist provides no real protection.

Proof of Concept Verified against phpSysInfo 3.4.x-main-d786ab2 running in a local Docker container (php:8.2-apache).

Deployment with the allowlist (under [main]) restricted to an address the attacker does not own:

ini ; phpsysinfo.ini ([main] section) ALLOWED=8.8.8.8

Request without the spoofed header — correctly denied (attacker's real IP is the container gateway 172.17.0.1):

bash $ curl -s http://localhost:8080/xml.php | head -c 200 Client IP address (172.17.0.1) not allowed.

Request with a spoofed X-Forwarded-For matching the allowlist — bypass, full system information returned:

bash $ curl -s -H "X-Forwarded-For: 8.8.8.8" http://localhost:8080/xml.php | head -c 200 <?xml version="1.0" encoding="UTF-8"?> <tns:phpsysinfo xmlns:tns="http://phpsysinfo.sourceforge.net/" ...>

The same bypass works with the Client-IP header (HTTPCLIENTIP), which is also trusted before REMOTEADDR.

Impact Any remote, unauthenticated attacker can defeat the PSIALLOWED access restriction and read the complete system information exposed by phpSysInfo, including hostname, kernel version, CPU model, memory layout, mounted filesystems, and all network interface addresses. This information is valuable for reconnaissance and targeting of further attacks.

Remediation Use REMOTEADDR as the authoritative client IP by default. Only honor X-Forwarded-For / Client-IP when the request originates from an explicitly configured list of trusted proxies, and when honoring it, parse the correct entry from the chain rather than trusting the whole header. Example direction:

php $ip = $SERVER["REMOTEADDR"]; if (defined('PSITRUSTEDPROXIES') && inarray($ip, $trustedproxies, true) && isset($SERVER["HTTPXFORWARDEDFOR"])) { // take the right-most untrusted hop from the XFF chain $parts = arraymap('trim', explode(',', $SERVER["HTTPXFORWARDEDFOR"])); $ip = end($parts); }

Discovery / Credit - Reported by: Muhammed Mirac Kayıkci - Coordinated disclosure; no third-party systems were tested. Verification performed against a local Docker deployment only.