CVE-2020-12477: 
PHP vulnerability analysis and mitigation

The REST API functions in TeamPass 2.1.27.36 contain a vulnerability (CVE-2020-12477) that allows any user with a valid API token to bypass IP address whitelist restrictions. This is accomplished by manipulating the X-Forwarded-For client HTTP header in requests to the getIp function (NVD, Debian Tracker).

The vulnerability exists in the IP whitelist feature of TeamPass which is designed to restrict source IP addresses that can interact with the system. The flaw occurs because the application trusts the first value in the X-Forwarded-For header from client requests to determine the source IP address. Since clients can control and modify this header, they can set it to any whitelisted IP address value, thereby circumventing the intended access restrictions (GitHub Issue).

An attacker with a valid API token can bypass IP address whitelist restrictions and access the TeamPass system from any IP address by simply including a whitelisted IP in the X-Forwarded-For header. This effectively renders the IP whitelist security control ineffective (GitHub Issue).

The vulnerability is relatively simple to exploit. An attacker only needs a valid API token and knowledge of a whitelisted IP address. The exploit can be triggered using a basic curl command with a modified X-Forwarded-For header, such as: curl -v -H "X-Forwarded-For: [whitelisted-ip]" http://localhost/teampass/api/index.php/info/version/?apikey=[valid-key] (GitHub Issue).

The fundamental fix requires not trusting client-provided headers for IP address validation. The only reliable source for client IP address information is the Source Address field in TCP packets. Server-side configurations should be used to determine the true client IP address rather than relying on the X-Forwarded-For header (GitHub Issue).