Skip to content

Does beef can be injected by X-Forwarded-For? #1354

@whirlwind110

Description

@whirlwind110

x-forwarded-for:8.8.8.8‘

E, [2017-02-04T14:24:30.715815 #11752] ERROR -- : Unexpected error while processing request: invalid address
	/usr/lib/ruby/2.3.0/ipaddr.rb:560:in `in6_addr'
	/usr/lib/ruby/2.3.0/ipaddr.rb:497:in `initialize'
	/usr/lib/ruby/2.3.0/ipaddr.rb:515:in `new'
	/usr/lib/ruby/2.3.0/ipaddr.rb:515:in `coerce_other'
	/usr/lib/ruby/2.3.0/ipaddr.rb:171:in `include?'
	/home/****/****/beef/extensions/admin_ui/controllers/authentication/authentication.rb:114:in `permited_source?'
	/home/****/****/beef/extensions/admin_ui/controllers/authentication/authentication.rb:49:in `login'
	/home/****/****/beef/extensions/admin_ui/classes/httpcontroller.rb:65:in `call'
	/home/****/****/beef/extensions/admin_ui/classes/httpcontroller.rb:65:in `run'
	/home/****/****/beef/extensions/admin_ui/handlers/ui.rb:31:in `call'
	/var/lib/gems/2.3.0/gems/rack-1.6.4/lib/rack/urlmap.rb:66:in `block in call'
	/var/lib/gems/2.3.0/gems/rack-1.6.4/lib/rack/urlmap.rb:50:in `each'
	/var/lib/gems/2.3.0/gems/rack-1.6.4/lib/rack/urlmap.rb:50:in `call'
	/var/lib/gems/2.3.0/gems/rack-1.6.4/lib/rack/commonlogger.rb:33:in `call'
	/var/lib/gems/2.3.0/gems/sinatra-1.4.7/lib/sinatra/base.rb:219:in `call'
	/var/lib/gems/2.3.0/gems/thin-1.6.4/lib/thin/connection.rb:86:in `block in pre_process'
	/var/lib/gems/2.3.0/gems/thin-1.6.4/lib/thin/connection.rb:84:in `catch'
	/var/lib/gems/2.3.0/gems/thin-1.6.4/lib/thin/connection.rb:84:in `pre_process'
	/var/lib/gems/2.3.0/gems/thin-1.6.4/lib/thin/connection.rb:53:in `process'
	/var/lib/gems/2.3.0/gems/thin-1.6.4/lib/thin/connection.rb:39:in `receive_data'
	/var/lib/gems/2.3.0/gems/eventmachine-1.0.9.1/lib/eventmachine.rb:193:in `run_machine'
	/var/lib/gems/2.3.0/gems/eventmachine-1.0.9.1/lib/eventmachine.rb:193:in `run'
	/var/lib/gems/2.3.0/gems/thin-1.6.4/lib/thin/backends/base.rb:73:in `start'
	/var/lib/gems/2.3.0/gems/thin-1.6.4/lib/thin/server.rb:162:in `start'
	/home/****/****/beef/core/main/server.rb:125:in `start'
	./beef:165:in `<main>'

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions