{"schema":"threatline.record/2","record":{"id":"GHSA-fcjm-xhw8-pmh5","aliases":["GHSA-fcjm-xhw8-pmh5"],"summary":"Authentication Bypass via X-Forwarded-For Spoofing in SuggestArr local_bypass Mode","details":"### Summary\r\n\r\n`enforce_authentication()` decides `local_bypass` trust from `request.remote_addr`, which `ProxyFix(x_for=1)` fills in from the `X-Forwarded-For` header. A spoofed loopback or private address therefore passes `_is_trusted_local_ip()`, and `_load_bypass_user_context()` returns an admin user.\r\n\r\n### Details\r\n\r\n- `api_service/auth/middleware.py`, `enforce_authentication()`:\r\n  - `client_ip = request.remote_addr`\r\n  - `if auth_mode == \"local_bypass\" and _is_trusted_local_ip(client_ip): _apply_auth_context(_load_bypass_user_context(), ...)`\r\n- `api_service/app.py:94`: `ProxyFix(application.wsgi_app, x_for=1, ...)`\r\n\r\n### Proof of concept\r\n\r\n1. Run `ciuse99/suggestarr:latest` with `AUTH_MODE=local_bypass` and `AUTH_TRUSTED_CIDRS=127.0.0.1/32`.\r\n2. Create the first admin user so the instance leaves setup mode.\r\n3. From a host outside the trusted range, request these endpoints without the header. Both return 401:\r\n```\r\nGET /api/users\r\nGET /api/jobs\r\n```\r\n4. Send the same requests with the spoofed header. Both return 200 with full admin data (the admin user list and job configs):\r\n```\r\nGET /api/users\r\nX-Forwarded-For: 127.0.0.1\r\n```\r\nThe two sets of requests differ only in the attacker-controlled header.\r\n\r\n### Impact\r\n\r\nWhen `local_bypass` mode is enabled, an unauthenticated remote attacker who can reach SuggestArr gets full admin access. The only requirement is an `X-Forwarded-For` header with an address inside the trusted CIDRs. The default CIDRs are `127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,::1,fc00::/7`. The attacker can read admin data such as the user list and job configurations.","categories":["Unclassified"],"product":"SuggestArr","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/giuseppe99barchetta/SuggestArr/security/advisories/GHSA-fcjm-xhw8-pmh5","source_modified_at":"2026-10-20T18:58:54Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"SuggestArr","ecosystem":null},"range":"<= 2.16.1"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/giuseppe99barchetta/SuggestArr/security/advisories/GHSA-fcjm-xhw8-pmh5","source_modified_at":"2026-10-20T18:58:54Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"SuggestArr","ecosystem":null},"version":"3.0.0"}],"cvss":9.1,"severity":"Critical","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-20T15:24:02Z","modified_at":"2026-10-20T18:58:54Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/giuseppe99barchetta/SuggestArr/security/advisories/GHSA-fcjm-xhw8-pmh5","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-20T18:58:54Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-20T18:58:54Z","content_hash":"3d8ae53113ccb9348b139935d13ed687609b361dab14005d7aaa218255642703"}}