Echo: X-Real-IP extractor trusts the header value instead of the sending peer

影響: go:github.com/labstack/echo/v5 >= 5.0.0, < 5.4.1 → 5.4.1

In Echo v5, ExtractIPFromRealIPHeader checked whether the address supplied in X-Real-IP belonged to a trusted range instead of checking the address of the direct network peer. An untrusted client could therefore supply a loopback or private address and have it returned by c.RealIP() with the extractor's default trust options. Applications using this extractor for IP allowlists, IP-based rate limiting, audit logs or forwarding headers could accept a spoofed client identity. Exploitation requires…

GitHub Advisory Database에서 읽기

2026. 10. 24. 오전 05:50, GitHub Advisory Database에서 "Echo: X-Real-IP extractor trusts the header value instead of the sending peer"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: Go, GitHub.