Reliance on Untrusted Inputs in a Security Decision Affecting github.com/labstack/echo/v4 package, versions >=4.0.0

Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the (*Context).RealIP method in context.go. When Echo#IPExtractor is unset, the default RateLimiter() uses ctx.RealIP() as its client identifier, and an attacker can evade throttling by sending requests with changing X-Forwarded-For values or, when that header is absent, changing X-Real-IP values. This lets attackers make repeated requests to rate-limited endpoints, including login and password-reset endpoints; the same legacy default remains in github.com/labstack/echo/v4 for compatibility.

Notes

• Reaching a rate-limited endpoint requires no authentication; any HTTP client can rotate the spoofed header values.

Workarounds

• Set Echo#IPExtractor to echo.ExtractIPDirect() when not behind a proxy, or to echo.ExtractIPFromXFFHeader() with TrustIPRange for trusted proxies; this prevents client-supplied forwarded-IP headers from choosing the rate-limit identity.
• Set RateLimiterConfig.IdentifierExtractor to an identifier clients cannot choose; this prevents attackers from rotating spoofed IP headers to obtain fresh rate-limit buckets.

• GitHub Commit
• Maintainer's Advisory