Horizon Alert
Summary of the vulnerability and why it matters
This issue in Cleanuparr allows an unauthenticated attacker to log in as an administrator by sending a specially crafted request. This happens because the tool incorrectly trusts a spoofed IP address in a request header, bypassing security checks and granting full control over the application.
- Remote attackers can gain admin access.
- Allows full control over Cleanuparr.
- Affects systems using versions prior to 2.9.10.
Attack Path
How an attacker could exploit the issue
An unauthenticated remote attacker can bypass authentication by sending a spoofed IP address in the `X-Forwarded-For` HTTP header. This allows them to trick Cleanuparr into believing they are a trusted local user, granting them administrator access to the application.
- Targets Cleanuparr application.
- Uses `X-Forwarded-For` header.
- Requires network access.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability allows unauthenticated remote attackers to gain administrator access by manipulating the `X-Forwarded-For` header. While the software is self-hosted, users may expose it via reverse proxies, making it reachable from the internet and thus a target. The fixed version was released recently.
- Exploitation requires specific network configuration.
- No public exploits are readily available.
- Fix is recent.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize patching Cleanuparr to version 2.9.10 or later to address the critical authentication bypass vulnerability. If patching is delayed, immediately isolate affected services from untrusted networks to prevent unauthenticated administrative access.
- Upgrade Cleanuparr to 2.9.10.
- Restrict network access to Cleanuparr.
- Monitor logs for suspicious authentication.
