#2821·beef

Review "IP address has changed" functionality

Author: bcolesCreated Apr 15, 2023Updated Apr 22, 2023
LabelsDefectLow

The "IP address has changed" functionality is dodgy. Worse, when allow_reverse_proxy is used, the X-Forwarded-For header is trusted implicitly without validation.

https://github.com/beefproject/beef/blob/943a6fd2266f2652e64885c499e8f8fb5735ac10/core/main/handlers/hookedbrowsers.rb#L93-L102

Here's an example someone provided, showing that the stored IP address contains two IP addresses separated by ,.

image

It may also result in many "IP address has changed" events in load balanced environments. Although I'm not sure that this is avoidable.