GHSA-h53f-rm2w-w7rg: Medium severity go/github.com/labstack/echo/v5 vulnerability
Impact
In Echo v5, ExtractIPFromRealIPHeader checked whether the address supplied in X-Real-IP belonged to a trusted range instead of checking the address of the direct network peer. An untrusted client could therefore supply a loopback or private address and have it returned by c.RealIP() with the extractor's default trust options.
Applications using this extractor for IP allowlists, IP-based rate limiting, audit logs or forwarding headers could accept a spoofed client identity. Exploitation requires that the attacker can reach Echo directly or that an intervening proxy passes through the attacker's X-Real-IP value. Applications using the default direct IP extractor are unaffected. Echo v4 is unaffected by this v5 regression.
Affected versions and patch
All v5 releases from v5.0.0 through v5.4.0 are affected. Upgrade to v5.4.1.
The patch validates the direct peer before accepting a syntactically valid X-Real-IP value, restoring the v4 trust model. Fix commit.
Workarounds
Use ExtractIPDirect until upgrading, or ensure that only trusted proxies can reach Echo and that they replace client-supplied forwarding headers. Configure trusted proxy ranges narrowly for the deployment.
Credits
Reported and patched by @rm-Umar. @Duodum independently reported the same issue in GHSA-c3r7-8j36-7mx8, which is tracked as a duplicate of this advisory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/labstack/echo/v5to a version that resolves this vulnerability.Fixed in 5.4.1 - Upgrade
Upgrade
Echo v5to a version that resolves this vulnerability.Fixed in v5.4.1 - Configuration
Use ExtractIPDirect until upgrading.
Echo v5 IP extractor = ExtractIPDirect - Configuration
Configure trusted proxy ranges narrowly for the deployment.
Echo v5 trusted proxy ranges = narrowly configured - Compensating control
Ensure that only trusted proxies can reach Echo and that they replace client-supplied forwarding headers.
Event History
Frequently Asked Questions
Which deployments are exposed to spoofed client IP addresses?
Echo v5 applications using ExtractIPFromRealIPHeader are exposed in versions v5.0.0 through v5.4.0. Echo v4 and applications using the default direct IP extractor are unaffected.
What must an attacker be able to do to exploit this issue?
The attacker must be able to reach the Echo application directly, or use an intervening proxy that passes the attacker-supplied X-Real-IP header through to Echo. No authentication or user interaction is required.
What application controls can be bypassed?
Any logic that relies on c.RealIP() while using the affected extractor may act on a spoofed identity. This includes IP allowlists, IP-based rate limiting, audit logging, and forwarding headers.
What should be done if an immediate upgrade is not possible?
Use ExtractIPDirect until the application can be upgraded. The fixed release is v5.4.1.