Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

FeedsContactPrivacy© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
ats-realip-plugin-acl — Apache Traffic Server 10.2.0 - High - Remote - Privilege leftover - realip PLUGIN ACL fail-open | Kitploit
Tools/GitHubGitHub/abraxas/ats-realip-plugin-acl
Authentication & AuthorizationVulnerability AnalysisWeb Proxies & InterceptionWeb SecurityPenetration TestingMisconfigurationLabs & Practice
GitHubabraxas/ats-realip-plugin-acl

ats-realip-plugin-acl

Apache Traffic Server 10.2.0 - High - Remote - Privilege leftover - realip PLUGIN ACL fail-open

View Repository
414 days agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Abraxas Labs - ats-realip-plugin-acl

abraxaslabs.tech  ·  github.com/abraxas  ·  @abraxas_null  ·  [email protected]  ·  ats-realip-plugin-acl

ats-realip-plugin-acl

Class: Privilege leftover Reach: Remote

Apache Traffic Server 10.2.0 (b1df7334) - Apache Software Foundation

experimental realip plus the documented acl.subjects: PLUGIN fail-opens remap @src_ip. If realip does not call TSHttpTxnVerifiedAddrSet, _verified_addr stays AF_UNSPEC. PLUGIN subject is never nullptr, so PEER fallback never runs. ats_is_ip is false, @src_ip is skipped, ip_matches stays true. A remap allow-list matches the untrusted client.

Default acl.subjects is PEER. realip is not in stock plugin.config. Session ip_allow.yaml never reads PLUGIN. Classic X-Forwarded-For-from-anyone is closed (trustedAddress required; header must be a single inet_pton address).

IDno CVE yet
ClassPrivilege leftover (remap ACL fail-open)
ReachRemote (unauth HTTP from outside trustedAddress)
CWECWE-863
CVSSHigh: 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
ProductApache Traffic Server
Affected10.2.0 (b1df7334b39a878971c376da849e8da4984918b6) experimental realip + PLUGIN subjects
Authnone. Client is not in trustedAddress.
LicenseGNU Affero GPL v3.0
Lab127.0.0.1:18770 only

I pinned public tag 10.2.0 peel b1df7334. The lab is a source-built ats-10.2.0-lab:local reverse proxy on loopback. CONTROL PEER 403. PLUGIN 200. Session PURGE still 403.

What an attacker can do

Reach ATS with experimental realip.so loaded and proxy.config.acl.subjects: PLUGIN (or PLUGIN,PEER). Remap @src_ip=10.0.0.0/8 allow. Connect from an address outside trustedAddress.

MethodSinkPrivilege
HTTP from 172.x outside trustedAddress to remap @src_ip=10.0.0.0/8realip skip TSHttpTxnVerifiedAddrSet (address_setter.cc:29-38); PLUGIN subject always present (UrlRewrite.cc:462-473); skip @src_ip when !ats_is_ip (:495-514)Integrity (lab-proven): remap ACL matches. Origin 200 ATS-REALIP-PLUGIN-ACL-WITNESS. CONTROL acl.subjects=PEER is 403.
Same plus Client-IP: 10.1.2.3 from the untrusted peersimple.cc verify false; header ignoredIntegrity (lab-proven): still fail-open 200. Not a spoof of the verified address.
Same client PURGEsession ip_allow.yaml PEERClosed (lab-proven): 403. PLUGIN never rewrites connection ACL.
Host without @src_ipdefault mapClosed (lab-proven): body DENIED, no witness.

Lab-proven vs inferred: PLUGIN 200, PEER 403, PURGE 403, denied map, untrusted header fail-open are lab. What the origin then grants is inferred from the remap that was supposed to be 10/8-only.

Requires: experimental realip.so plus acl.subjects=PLUGIN (or PLUGIN,PEER). Remap @src_ip allow-list. Not default.

Adjacent surface that stays closed

SurfaceLab
CONTROL acl.subjects=PEER403 on the same @src_ip map
Session ip_allow.yamlattacker PURGE 403
Map without @src_ipDENIED
Empty trustedAddressnever verifies; still fail-open only when subjects is PLUGIN
Classic XFF-from-anyoneclosed. Header must be a single inet_pton address from a trusted peer
SNI ip_allowPEER/PROXY only; handshake is before HTTP headers
Default subjects PEERleftover does not apply

Not the classic "trust X-Forwarded-For from anyone" leftover. The leftover is the documented PLUGIN remap ACL path.

Lab

python3 ats-realip-plugin-acl-Abraxas-Labs.py

or

cd lab
./run.sh

Loopback 127.0.0.1:18770 (origin 18771). Compose project ats-realip-plugin-acl. Image ats-10.2.0-lab:local. Attacker sidecar 172.x. Witness ATS-REALIP-PLUGIN-ACL-WITNESS. Last line:

SUCCESS ats-realip-plugin-acl control-http=403 poc-http=200 purge-http=403 denied-http=200 spoof-http=200 trusted-http=200 ATS-REALIP-PLUGIN-ACL-WITNESS

The fix

Treat PLUGIN as unavailable when get_verified_client_addr is AF_UNSPEC (or make the getter return nullptr, matching TSHttpTxnVerifiedAddrGet). Then PEER fallback runs. Do not skip @src_ip when the subject pointer is non-null but not an IP. Fail closed on an allow-list.

Until then, leave acl.subjects at PEER if you load realip only for logging. Do not set PLUGIN unless every client that can hit the remap is already a trusted proxy.

References

  • github.com/apache/trafficserver tag 10.2.0 (b1df7334b39a878971c376da849e8da4984918b6)
  • plugins/experimental/realip/address_setter.cc
  • src/proxy/http/remap/UrlRewrite.cc PerformACLFiltering
  • include/proxy/ProxyTransaction.h get_verified_client_addr
  • realip admin guide
  • CWE-863
Download Tool