Reverse Proxy Header
CVE-2025-10929
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Drupal site using module
-
ExploitSend request with forged proxy headers
-
ExecutionModule trusts manipulated user-controlled variable
-
ImpactSpoofed client identity / disclosed info
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Hardware validation bypass
|
| Exploitation Conditions | Exploitation requires that the target Drupal site has the Reverse Proxy Header contrib module installed and configured to trust client-identifying headers from an upstream reverse proxy - this deployment mode IS the precondition. Where present, no authentication or user interaction is needed (PR:N/UI:N) and the request is remote (AV:N). Limiting factors: sites not using this module, or not relying on the trusted headers for access control, are unaffected; impact is bounded (CVSS low), and the real exposure depends on whether downstream logic trusts the manipulated variable for security decisions. Versions at or above 1.1.2 are fixed. |
| Impact | This is a moderate-severity (CVSS 5.3), low-priority issue in practice. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates a network-reachable, low-complexity flaw exploitable by unauthenticated attackers, which raises its theoretical reach, but all three real-world exploitation signals point low: EPSS is 0.30% (21st percentile), the CVE is NOT on the CISA KEV list, and no public proof-of-concept was provided in the input (no public exploit identified at time of analysis). There is a notable signal conflict: the provided CVSS vector sets C:N/I:N/A:L (availability-only impact), yet the Tags and CWE-1288 (Improper Validation of Consistency within Input / user-controlled variable manipulation) describe an Information Disclosure / trust-spoofing weakness, which is a confidentiality/integrity concern rather than availability - verify the true impact with the Drupal advisory. No SSVC decision data was provided. Net: a real but low-urgency issue affecting a niche Drupal contrib module; patch during normal maintenance rather than as an emergency. |
| Exploit ScenarioDerived | A Drupal site uses the Reverse Proxy Header module to trust client-identifying headers (e.g. X-Forwarded-For) from an upstream proxy. Because the module improperly validates consistency of this user-controllable input, a remote unauthenticated attacker sends a request with forged proxy headers to spoof their apparent source address or manipulate trusted variables, potentially bypassing IP-based controls or disclosing/altering trust-dependent behavior. No public exploit code was identified, and exploitation requires that the site actually deploy and rely on this module behind a reverse proxy. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Improper validation of consistency within input in the Drupal contributed module Reverse Proxy Header (versions 0.0.0 through 1.1.1) allows manipulation of user-controlled variables derived from client-supplied HTTP headers. Affected sites are those that install the module and configure it to trust client-identifying headers from an upstream reverse proxy; in that deployment, unauthenticated remote attackers (CVSS PR:N) can send inconsistent or conflicting header values that the module fails to reconcile, potentially influencing downstream logic that consumes those variables. This is a moderate-severity (CVSS 5.3), low-priority issue in practice: EPSS is only 0.30% (21st percentile), there is no CISA KEV listing for active exploitation, and no public exploit code has been identified at time of analysis. A vendor patch is available in version 1.1.2.
RemediationAI
Apply the vendor-released patch by upgrading the Reverse Proxy Header module to version 1.1.2 or later; the fix is documented in Drupal security advisory sa-contrib-2025-111 at https://www.drupal.org/sa-contrib-2025-111. Run the module update as part of your normal Drupal maintenance cycle and confirm the installed version via the site's available-updates report. Where an immediate upgrade is not possible, the most effective compensating control is to stop trusting client-identifying headers from untrusted sources: ensure the Drupal origin is reachable only from the reverse proxy (for example, restrict inbound traffic to the proxy's IP range or a private network segment, and keep the origin behind a firewall or authenticated mTLS so direct clients cannot inject headers), and strip or normalize any forwarding headers at the proxy edge, rewriting X-Forwarded-For/X-Real-IP/Forwarded to a single consistent value. The trade-off of network-level restriction is added configuration overhead and potential breakage if legitimate traffic reaches the origin by another path, and header normalization can break clients that legitimately chain proxies. Additionally, audit downstream modules and logging that consume the derived client variables and remove any security decisions based purely on those values until the upgrade is complete. Patch status: vendor-released patch available (version 1.1.2).
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in composer
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the Drupal contributed module Reverse Proxy Header (CPE cpe:2.3:a:reverse_proxy_header_project:reverse_proxy_header), which exists to reconstruct correct client information (such as client IP, host, and protocol) when Drupal sits behind a reverse proxy or load balancer. Such modules typically map trusted upstream headers like X-Forwarded-For, X-Real-IP, X-Forwarded-Host, or Forwarded onto Drupal's internal request variables. The assigned CWE-1288 (Improper Validation of Consistency within Input) describes a root-cause class in which multiple representations of what should be the same value are not checked against each other: for example, when a request carries conflicting or duplicated forwarding headers (multiple X-Forwarded-For entries, mismatched Forwarded directives, or disagreement between several header variants), the module does not verify that the values are mutually consistent before deriving the user-controlled variable. Because the derived value may then be trusted by Drupal or by other modules for logging, access decisions, or redirect/caching behavior, an attacker who can reach the site through the proxy can influence that variable. Exploitation requires the module to be installed and configured to trust client-identifying headers from an upstream reverse proxy; that deployment mode is itself the precondition. The code is fixed in 1.1.2, and the issue was reported by mlhess@drupal.org under Drupal security advisory sa-contrib-2025-111.
Know when Reverse Proxy Header gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Remote unauthenticated header manipulation (AV:N/AC:L/PR:N/UI:N) that spoofs trusted client variables yields limited confidentiality/integrity impact; NVD's A:L appears misattributed for a trust-spoofing flaw.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
DescriptionCVE.org
Improper Validation of Consistency within Input vulnerability in Drupal Reverse Proxy Header allows Manipulating User-Controlled Variables.This issue affects Reverse Proxy Header: from 0.0.0 before 1.1.2.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GitHub PoC
Exploit-DB