GHSA-h53f-rm2w-w7rg: Echo: X-Real-IP extractor trusts the header value instead of the sending peer

In Echo v5, ExtractIPFromRealIPHeader checked whether the address supplied in X-Real-IP belonged to a trusted range instead of checking the address of the direct network peer. An untrusted client could therefore supply a loopback or private address and have it returned by c.RealIP() with the extractor’s default trust options.

Applications using this extractor for IP allowlists, IP-based rate limiting, audit logs or forwarding headers could accept a spoofed client identity. Exploitation requires that the attacker can reach Echo directly or that an intervening proxy passes through the attacker’s X-Real-IP value. Applications using the default direct IP extractor are unaffected. Echo v4 is unaffected by this v5 regression.