CVE-2026-55584: 
PHP 脆弱性の分析と軽減

CVE-2026-55584 is an IP allowlist bypass vulnerability in phpSysInfo, a customizable PHP system information script. The flaw exists in read_config.php, where the PSI_ALLOWED access-control check unconditionally trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers over the authoritative REMOTE_ADDR, allowing any unauthenticated remote attacker to impersonate a trusted IP address. All versions up to and including 3.4.5 are affected; the issue was fixed in version 3.4.6. It carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, phpsysinfo Advisory). The vulnerability was reported by Muhammed Mirac Kayıkci and published to the GitHub Advisory Database on August 28, 2026.

The root cause is CWE-290 (Authentication Bypass by Spoofing): read_config.php resolves the client IP by checking HTTP_X_FORWARDED_FOR first, then HTTP_CLIENT_IP, and only falling back to REMOTE_ADDR if neither header is present. Since both X-Forwarded-For and Client-IP are fully attacker-controlled HTTP request headers, an attacker can supply any IP address in these headers to satisfy the PSI_ALLOWED allowlist check — even when phpSysInfo is deployed without any reverse proxy. The vulnerable code pattern is:

if (isset($_SERVER["HTTP_X_FORWARDED_FOR"])) {
    $ip = $_SERVER["HTTP_X_FORWARDED_FOR"];
} else {
    if (isset($_SERVER["HTTP_CLIENT_IP"])) {
        $ip = $_SERVER["HTTP_CLIENT_IP"];
    } else {
        $ip = $_SERVER["REMOTE_ADDR"];
    }
}

The fix in v3.4.6 introduces a PSI_TRUSTED_PROXIES configuration option; proxy headers are only honored when the actual REMOTE_ADDR matches a configured trusted proxy, and the rightmost untrusted hop is extracted from the XFF chain (phpsysinfo Advisory, Patch Commit).

Successful exploitation allows any unauthenticated remote attacker to bypass the sole IP-based access restriction and read all system information exposed by phpSysInfo, including hostname, kernel version, CPU model, memory layout, mounted filesystems, and all network interface addresses and IP assignments. There is no integrity or availability impact; the vulnerability is purely a confidentiality breach. The disclosed information is directly useful for reconnaissance, enabling attackers to map the target environment and identify further attack vectors against the host or its network (phpsysinfo Advisory, Github Advisory).

A public proof-of-concept exploit is available on GitHub, demonstrating the bypass with a simple curl command using a spoofed X-Forwarded-For header (PoC GitHub). No privileges or user interaction are required, and attack complexity is low, making this trivially exploitable by any remote attacker. As of the time of publication, there is no evidence of in-the-wild exploitation, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 2.42% (83rd percentile), indicating a moderate probability of exploitation within 30 days (Github Advisory). Detection is available via Nessus plugin ID 341559.

1. Reconnaissance: Identify internet-facing phpSysInfo instances (versions ≤ 3.4.5) using search engines like Shodan or Censys, or by scanning for the default xml.php or index.php endpoints. Look for the characteristic phpSysInfo page title or XML output structure.
2. Probe for access restriction: Send a plain HTTP request to the target's xml.php endpoint without any spoofed headers. If PSI_ALLOWED is configured, the server will respond with Client IP address (<your_ip>) not allowed.
3. Identify an allowed IP: Determine an IP address in the PSI_ALLOWED allowlist. Common values include 127.0.0.1, 8.8.8.8, or internal network ranges. This may require guessing common configurations or obtaining the phpsysinfo.ini through other means.
4. Spoof the header to bypass the allowlist: Send a crafted HTTP request with the X-Forwarded-For header set to an allowed IP address:

curl -s -H "X-Forwarded-For: 8.8.8.8" http://target/xml.php

Alternatively, use the Client-IP header if X-Forwarded-For is filtered:

curl -s -H "Client-IP: 8.8.8.8" http://target/xml.php

5. Harvest system information: Parse the returned XML response to extract hostname, kernel version, CPU details, memory configuration, mounted filesystems, and all network interface addresses for use in further reconnaissance or targeted attacks (phpsysinfo Advisory, PoC GitHub).

• Network: HTTP requests to /xml.php, /index.php, or other phpSysInfo endpoints containing X-Forwarded-For or Client-IP headers with IP addresses not belonging to known reverse proxies; repeated access attempts from a single external IP with varying spoofed header values.
• Logs: Web server access logs (Apache/Nginx) showing requests to phpSysInfo endpoints with X-Forwarded-For or Client-IP headers set to allowlisted IPs (e.g., 8.8.8.8, 127.0.0.1) from unexpected remote addresses; successful 200 responses to xml.php from IPs not in the configured PSI_ALLOWED list.
• Application: Absence of Client IP address not allowed denial messages in logs for requests that should have been blocked based on REMOTE_ADDR; unexpected access to phpSysInfo from geographic regions or IP ranges inconsistent with the organization's user base.

Upgrade phpSysInfo to version 3.4.6 or later, which introduces the PSI_TRUSTED_PROXIES configuration option and fixes the header-trust logic to use REMOTE_ADDR as the authoritative client IP by default (phpsysinfo Release, Patch Commit). For deployments that cannot immediately upgrade, configure the web server or a WAF to strip or reject X-Forwarded-For and Client-IP headers from untrusted external sources before they reach phpSysInfo. Additionally, implement network-level controls (firewall rules) to restrict access to phpSysInfo endpoints to trusted IP ranges, providing defense-in-depth independent of the application's own access control.