Spoofed X-Forwarded-For header bypasses ezBookkeeping IP allowlist and forges audit logs
A single forged X-Forwarded-For header lets any remote caller defeat ezBookkeeping’s configured IP allowlist and have actions logged under a trusted address instead of the attacker’s own IP, according to the GitHub advisory.
- Affected
- github.com/mayswind/ezbookkeeping (go): >= 0.10.0, < 1.6.0
- Fixed
- github.com/mayswind/ezbookkeeping (go): 1.6.0
The web server builds its Gin router with gin.New() and never calls SetTrustedProxies, so ClientIP() echoes the attacker-supplied header. Both the MCP and API-token allowlists are checked against that value. A valid MCP or API token is still needed for protected actions; the flaw removes the IP compensating control, not the token requirement.
One header can therefore pass the IP gate from any source address, and the spoofed address is written to Transaction.CreatedIp and the access log, forging attribution. The reported runtime proof shows a blocked 400 without the header and an allowed 200 with an allowlisted spoofed IP.
Upgrade github.com/mayswind/ezbookkeeping to version 1.6.0; versions >= 0.10.0 and < 1.6.0 are affected.
Sources & technical scope 2 sources
GitHub Advisory Database — original source ↗
GitHub_M CNA / CVE Program — original source ↗
Affected: github.com/mayswind/ezbookkeeping (go): >= 0.10.0, < 1.6.0
Fixed: github.com/mayswind/ezbookkeeping (go): 1.6.0
Exploitation: Known exploitation is not established by the supplied evidence.
Scope & limitations: Individually tested deployed versions and KEV status are not established by the supplied evidence; the advisory and vendor CNA establish the affected range and fix.
External findings belong to the credited researchers.