Origin Validation Error Affecting github.com/labstack/echo/v5/middleware package, versions <5.4.0

github.com/labstack/echo/v5/middleware is a middleware package for echo.

Affected versions of this package are vulnerable to Origin Validation Error via the ToMiddleware function in the Echo proxy middleware. When Echo#IPExtractor is unset, an attacker can bypass upstream IP-based access controls and poison rate-limit and audit data by sending a request with a forged X-Real-IP header, which the proxy forwards unchanged.

Notes

• At the upstream authorization step, bypassing an IP allowlist requires the upstream to trust X-Real-IP and the attacker to supply an allowed address; otherwise the forged value can still poison IP-based logging or rate limits.

Workarounds

• Configure Echo#IPExtractor for your deployment—for example, echo.ExtractIPDirect() when there is no proxy in front of the application, or echo.ExtractIPFromXFFHeader() / echo.ExtractIPFromRealIPHeader() with TrustIPRange for proxies on public addresses. This makes the proxy overwrite a client-supplied X-Real-IP with an address derived by the configured extractor, preventing clients from spoofing the IP seen by upstream services.

• GitHub Commit
• GitHub Commit v4.16.0
• Maintainer's Advisory