GHSA-v938-v8wg-9497: Zipline 4.3.2 before 4.8.0 Rate Limit Bypass via Spoofed X-Forwarded-For
Zipline 4.3.2 before 4.8.0 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade throttling by spoofing X-Forwarded-For headers when core.trustProxy is enabled. Attackers can send a different X-Forwarded-For value per request to obtain fresh rate-limit buckets, enabling unlimited guessing of login passwords, TOTP codes, and file and URL passwords.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ziplineto a version that resolves this vulnerability.Fixed in 4.8.0
Event History
Frequently Asked Questions
Which deployments are exposed to this rate-limit bypass?
Zipline versions from 4.3.2 before 4.8.0 are affected when core.trustProxy is enabled. The issue is remotely exploitable without authentication.
What does an attacker need to bypass throttling?
An attacker only needs to send requests with spoofed X-Forwarded-For headers, using a different value for each request. This causes requests to be assigned fresh rate-limit buckets.
What attacks become more practical if the issue is exploited?
The bypass enables unlimited guessing attempts against login passwords, TOTP codes, and file or URL passwords. Availability is not identified as affected in the provided impact vector.