oss-security - Session IP check bypass in Roundcube 1.0

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <5abe3d0eae67015fea3d3674277b45e7@tribut.de>
Date: Wed, 09 Apr 2014 10:57:16 +0200
From: Felix Eckhofer <felix@...but.de>
To: oss-security@...ts.openwall.com
Subject: Session IP check bypass in Roundcube 1.0

Hi.

Roundcube 1.0-beta added support for the the X-Forwarded-For and 
X-Real-IP HTTP headers when the check_ip configuration option is set. 
This effectively allows the attacker to bypass the session IP check 
completely by setting one of these headers to the victim's IP address.

The problem is still present in the latest version (1.0).
Bug is being tracked here: http://trac.roundcube.net/ticket/1489729

Regards
felix

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.