A critical IP spoofing vulnerability in MegaEase EaseProbe allows unauthenticated remote attackers to bypass security controls by manipulating HTTP headers.

The application utilizes the RealIP middleware from the go-chi/chi/v5 library, which improperly trusts client-supplied HTTP headers such as X-Forwarded-For, X-Real-IP, and True-Client-IP without validating the request source. This allows an unauthenticated remote attacker to spoof their source IP address, effectively bypassing IP-based access lists and security filters.

Successful exploitation allows an attacker to masquerade as an internal or trusted host, potentially gaining unauthorized access to restricted administrative interfaces or sensitive endpoints. Furthermore, by spoofing IP addresses, attackers can evade rate limiting and pollute audit logs, hindering incident response and forensic investigations. Given the CVSS score of 7.3, this represents a significant risk to the integrity of access control mechanisms.

Immediate Action: Update the underlying go-chi/chi/v5 dependency to version 5.3.0 or later, which includes mandatory validation of trusted proxy CIDRs. If no reverse proxy is utilized in front of the EaseProbe instance, remove the middleware.RealIP implementation from the web/server.go file entirely.

Proactive Monitoring: Review application logs for suspicious entries where the source IP address appears to be internal or loopback (127.0.0.1) when originating from external network segments. Monitor for unusual patterns in requests that might indicate attempts to brute force or bypass rate-limiting controls.

Compensating Controls: Implement a strict Web Application Firewall (WAF) rule to strip or sanitize incoming X-Forwarded-For, X-Real-IP, and True-Client-IP headers unless they originate from known, trusted internal proxy servers.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub repository referenced in the research write-up.

The presence of a published proof-of-concept significantly elevates the risk of this vulnerability being weaponized. Organizations using EaseProbe should prioritize the dependency update or code modification described above to prevent unauthorized access and maintain the integrity of their security logging and access control infrastructure.