A vulnerability in FileCodeBox allows unauthenticated remote attackers to bypass rate limiting protections, facilitating brute force and denial of service attacks.

This flaw exists in the IPRateLimit implementation where the application improperly trusts user-supplied X-Real-IP and X-Forwarded-For HTTP headers. This allows unauthenticated attackers to manipulate their perceived source IP address to circumvent security controls.

The ability to bypass rate limits significantly lowers the barrier for attackers to conduct brute force attacks against share codes or launch denial of service attacks against the infrastructure. With a CVSS score of 7.5, this vulnerability represents a high risk to service availability and data integrity, as it renders standard defensive throttling ineffective.

Immediate Action: Monitor official repository updates at the FileCodeBox GitHub page and upgrade to a version beyond 2.2 as soon as a patch is released.

Proactive Monitoring: Review application access logs for unusual patterns of requests originating from diverse or unexpected IP addresses that might indicate header manipulation attempts.

Compensating Controls: Configure upstream proxies or Web Application Firewalls to sanitize or strip X-Forwarded-For headers from incoming requests to ensure the application receives the true client IP address.

Public Exploit Available: Unknown.

Given the ease of exploitation, security teams must prioritize the implementation of proxy-level header sanitization to mitigate this risk. Monitor the FileCodeBox project repository closely for formal patch releases and apply them immediately to restore the integrity of the rate-limiting mechanism.