Executive brief
MegaEase EaseProbe is a lightweight health-checking tool used to monitor service availability and status. A flaw in versions up to 2.3.0 allows attackers to spoof their source IP address by manipulating HTTP headers (X-Forwarded-For, X-Real-IP, True-Client-IP), bypassing IP-based access controls, evading rate limits, and polluting audit logs with forged IP addresses.
Technical details
The vulnerability exists in the middleware.RealIP function used in web/server.go (line 182), which trusts HTTP headers (X-Forwarded-For, X-Real-IP, True-Client-IP) without validating the request source or trusted proxy CIDR blocks. The vulnerable code directly extracts the client IP from these attacker-controlled headers and overwrites the RemoteAddr field with the spoofed value. While the code performs basic IP format validation using net.ParseIP(), it does not verify whether the request originates from a trusted reverse proxy. An unauthenticated remote attacker can craft HTTP requests with malicious header values to spoof their source IP, enabling bypass of IP-based access controls, circumvention of rate limiting mechanisms, and pollution of audit logs with forged addresses. Patches are available in go-chi/chi/v5 v5.3.0 and later versions of EaseProbe that upgrade this dependency.
Affected products
- MegaEase EaseProbe up to 2.3.0
Timeline
- 2026-08-31: disclosed
- 2026-08-31: other: Exploit published on GitHub