Simple Router
Monthly
IP whitelist and blacklist enforcement in the Pecee simple-php-router library through version 5.4.1.7 can be bypassed by remote unauthenticated attackers, allowing access to routes that are supposed to be restricted by client IP. The IpRestrictAccess middleware derives the caller's address from spoofable HTTP headers - X-Forwarded-For, CF-Connecting-IP, and Client-IP - instead of the trusted socket address, so a crafted request can impersonate a whitelisted host or slip past a blacklist. Impact is limited to confidentiality and integrity of the protected routes (moderate severity); no public exploit code has been identified at time of analysis and there is no CISA KEV listing, but exploitation requires only that the target application actually uses this middleware, and no credentials or user interaction are needed.
IP whitelist and blacklist enforcement in the Pecee simple-php-router library through version 5.4.1.7 can be bypassed by remote unauthenticated attackers, allowing access to routes that are supposed to be restricted by client IP. The IpRestrictAccess middleware derives the caller's address from spoofable HTTP headers - X-Forwarded-For, CF-Connecting-IP, and Client-IP - instead of the trusted socket address, so a crafted request can impersonate a whitelisted host or slip past a blacklist. Impact is limited to confidentiality and integrity of the protected routes (moderate severity); no public exploit code has been identified at time of analysis and there is no CISA KEV listing, but exploitation requires only that the target application actually uses this middleware, and no credentials or user interaction are needed.