Listen to this Post
How the CVE Works:
The vulnerability is a header shadowing attack in the cpp-httplib library. When an HTTP request is processed, attacker-controlled headers like `REMOTE_ADDR` and `LOCAL_PORT` are first parsed into the request’s header multimap via the `read_headers()` function. Later, the server’s `Server::process_request` method appends its own internal metadata using the exact same header names but does not remove the client-supplied duplicates. Since the `Request::get_header_value` method returns the first entry (id == 0) for a given header key, any downstream code—such as IP-based authorization checks or logging functions in docker/main.cc—will retrieve the attacker’s spoofed value instead of the true server-generated metadata. This allows for IP spoofing, log poisoning, and authorization bypass.
dailycve form:
Platform: cpp-httplib
Version: < 0.27.0
Vulnerability: Header Shadowing
Severity: Critical
date: 2025-12-05
Prediction: 2025-12-04
What Undercode Say:
Showing bash commands and codes related to the blog
Curl command demonstrating header injection
curl -H "REMOTE_ADDR: 192.168.1.100" -H "LOCAL_PORT: 8080" http://target-server/api/endpoint
Example of vulnerable code path in logging (conceptual)
void nginx_access_logger(const Request& req) {
std::string ip = req.get_header_value("REMOTE_ADDR"); // Gets attacker's value
log_access(ip); // Log is poisoned
}
How Exploit:
An attacker sends crafted HTTP requests containing fraudulent REMOTE_ADDR, REMOTE_PORT, LOCAL_ADDR, or `LOCAL_PORT` headers. These headers are accepted by the server, shadowing the legitimate server-assigned values. This can bypass IP-based access controls, falsify audit logs, and manipulate any application logic that relies on these header values for security decisions.
Protection from this CVE:
Immediately upgrade the cpp-httplib library to version 0.27.0 or later, where this vulnerability is fixed. As a general best practice, implement additional server-side validation for critical metadata and avoid relying solely on client-supplied headers for authorization.
Impact:
The impact is severe, with a CVSS v3.1 score of 10.0. It enables authentication bypass via IP spoofing, poisons server logs to hinder forensic analysis, and can lead to unauthorized access to sensitive data or administrative functions.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
