Pyload ng: pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header

pyLoad-ng's web UI request handling derives the client IP from the leftmost value of the X-Forwarded-For HTTP header without verifying if the header is trustworthy. Since the Cheroot WSGI server terminates client connections directly and no trusted proxy middleware (e.g., ProxyFix) is configured, the XFF header is fully attacker-controlled. The client IP is used in the rate_limit decorator to enforce request limits per IP and in audit logs for login and API-key authentication failures. Because the client can supply arbitrary XFF values, they can bypass rate limiting by sending a unique IP each request and forge IP addresses in logs, defeating IP-based blocking mechanisms like fail2ban and poisoning attribution. The vulnerability affects pyLoad-ng 0.5.0b3 and later develop snapshots with identical relevant code. No trusted proxy configuration or fallback to remote_addr is used unless the header is absent. The issue is confirmed by proof-of-concept testing showing rate limits are enforced only when XFF is fixed, but bypassed when rotated.

Attackers can bypass rate limiting controls by rotating the X-Forwarded-For header value, allowing unlimited requests without triggering rate limits. They can also spoof source IP addresses in security and audit logs for login and API-key authentication failures, which can defeat IP-based blocking tools and mislead forensic investigations. This undermines the effectiveness of IP-based security controls and log-based detection or blocking mechanisms.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. As a mitigation, pyLoad-ng should be configured to trust only known proxy headers or ignore untrusted X-Forwarded-For headers when no trusted proxy is present. Implementing middleware such as ProxyFix or equivalent to validate and sanitize client IP headers is recommended. Until a fix is available, administrators should be aware that IP-based rate limiting and logging can be bypassed or spoofed.