Executive brief
CakePHP, a popular web development framework, contains a vulnerability that allows attackers to fake their source IP address. By sending a specially crafted web request, an attacker can trick the application into believing they are connecting from a trusted location. This can be used to bypass security restrictions, access private data, or perform unauthorized actions on the website.
Technical details
The clientIp() method in CakePHP's Request classes (both 2.x and 3.x branches) prioritizes the HTTP_CLIENT_IP header over the REMOTE_ADDR variable provided by the web server. Because this header can be easily manipulated by a remote attacker via the 'CLIENT-IP' HTTP header, an attacker can provide an arbitrary IP address. This spoofed address is often used by applications for Access Control Lists (ACLs) or logging. If the application does not further sanitize this input, it can also lead to secondary vulnerabilities like Cross-Site Scripting (XSS) or SQL injection if the spoofed IP string is reflected or stored. The issue is fixed in versions 2.6.13, 2.7.11, 2.8.2, 3.0.17, 3.1.12, and 3.2.5.
Affected products
- CakePHP CakePHP 2.x before 2.6.13, 2.7.11, 2.8.2; 3.x before 3.0.17, 3.1.12, 3.2.5
Timeline
- 2016-03-13: patched: Vendor released security updates across multiple branches.
- 2016-05-12: disclosed: Original researcher advisory released.
- 2017-01-23: advisory: NVD published the CVE record.