Use of Less Trusted Source Affecting github.com/labstack/echo/v5/middleware package, versions >=5.0.0 <5.4.1

github.com/labstack/echo/v5/middleware is a middleware package for echo.

Affected versions of this package are vulnerable to Use of Less Trusted Source via the ExtractIPFromRealIPHeader function in ip.go. With the extractor’s default trust options, an attacker can make c.RealIP() return a forged loopback or private address by sending an X-Real-IP header, causing applications that rely on IP allowlists, rate limits, or audit logs to accept or record a spoofed client identity. Exploitation requires the attacker to reach Echo directly or an intervening proxy to pass through the attacker-supplied header.

Notes

• At the X-Real-IP validation step, the spoofed value must parse as an IP within the extractor’s configured trusted ranges; loopback and private addresses qualify under the default trust options.

Workarounds

• Use ExtractIPDirect instead of ExtractIPFromRealIPHeader to avoid accepting a spoofed X-Real-IP value.
• Restrict access to Echo so only trusted proxies can connect, and configure those proxies to replace client-supplied forwarding headers. This prevents direct clients from supplying a forged X-Real-IP value.
• Configure trusted proxy ranges narrowly to prevent untrusted peers from being treated as trusted.

• GitHub Commit
• GitHub Commit v5.4.1
• Maintainer's Advisory