Summary
Rate limiting is applied to most API endpoints by default. However, in some incorrect configurations, the measure can be circumvented by setting the request header X-Forwarded-For: 127.0.0.1.
Details
Provided they manage to directly connect to puma, an attacker can spoof their IP address by setting the X-Forwarded-For or Client-Ip HTTP header, and use that to bypass most rate-limiting.
Indeed, Rails' RemoteIp middleware, as used in Mastodon, will always trust the last (closest) X-Forwarded-For or Client-Ip header even if it comes from an untrusted source.
Furthermore, most of Mastodon's rate-limiting is done through rack-attack and explicitly exempting 127.0.0.1 from those, allowing an attacker to bypass them if they manage to spoof their IP address.
Impact
By bypassing the rate limiting measure, all other protective measures based on it (such as brute force detection) are also rendered ineffective.
An attacker could, for example, try to guess valid usernames and corresponding passwords in an automated fashion.
In addition, users could use the X-Forwarded-For header to pretend to connect from a different IP address (in the associated log entry).
However, the impact is limited by the fact that the attacker needs to be able to provide its own X-Forwarded-For or Client-Ip header without any being appended by a remote-proxy, effectively requiring the Mastodon server to be misconfigured.
Summary
Rate limiting is applied to most API endpoints by default. However, in some incorrect configurations, the measure can be circumvented by setting the request header
X-Forwarded-For: 127.0.0.1.Details
Provided they manage to directly connect to
puma, an attacker can spoof their IP address by setting theX-Forwarded-FororClient-IpHTTP header, and use that to bypass most rate-limiting.Indeed, Rails'
RemoteIpmiddleware, as used in Mastodon, will always trust the last (closest)X-Forwarded-FororClient-Ipheader even if it comes from an untrusted source.Furthermore, most of Mastodon's rate-limiting is done through
rack-attackand explicitly exempting 127.0.0.1 from those, allowing an attacker to bypass them if they manage to spoof their IP address.Impact
By bypassing the rate limiting measure, all other protective measures based on it (such as brute force detection) are also rendered ineffective.
An attacker could, for example, try to guess valid usernames and corresponding passwords in an automated fashion.
In addition, users could use the X-Forwarded-For header to pretend to connect from a different IP address (in the associated log entry).
However, the impact is limited by the fact that the attacker needs to be able to provide its own
X-Forwarded-FororClient-Ipheader without any being appended by a remote-proxy, effectively requiring the Mastodon server to be misconfigured.Note
This security issue has been found by mgm security partners, during a security audit commissioned by the BSI.