Description
PairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer._setIP that allows remote attackers to join other networks' discovery rooms by supplying a forged cf-connecting-ip header. Attackers who know a victim's public IP can appear as a local device on self-hosted instances not behind Cloudflare to send or receive files.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
schlagmichdoch PairDrop
Default version status: unaffected
0 to ≤ 1.11.2affected
References
- https://github.com/schlagmichdoch/PairDrop/issues/510 ↗
- https://github.com/schlagmichdoch/PairDrop ↗
- https://github.com/schlagmichdoch/PairDrop/blob/4862ba3067be1a0f2e0d1e94861dc9200b5bfeea/server/peer.js#L44-L54 ↗
- https://github.com/schlagmichdoch/PairDrop/blob/4862ba3067be1a0f2e0d1e94861dc9200b5bfeea/server/ws-server.js#L312-L314 ↗
- https://www.vulncheck.com/advisories/pairdrop-through-1.11.2-ip-spoofing-via-cf-connecting-ip-header ↗