# Spoofable client IP header trusted

Code overwrites REMOTE_ADDR from client-supplied proxy headers before loopback or admin checks

_Area: Web infrastructure and server-side requests. Seen in 3 disclosed reports; 2 confirmed bounties: $500 and $500; latest 2026-10-30. Updated 2026-11-02._

## How it works
An app decides "who is calling" from a header the client controls (X-Forwarded-For, Fastly-Client-IP, or a protocol-level sender address). It assumes that header is set only by a trusted proxy or router in front of it. When the app is reachable directly, or the front end does not strip/overwrite the header, the attacker sets it to a privileged value (127.0.0.1, a reserved local router ID) and passes any check that keys on client address. The broken assumption: "client address in the request reflects the real peer." [E2](https://bugbountylibrary.com/r/blog%3Ablog-assetnote-io-bug-bounty-2019-03-19-rce-on-mozilla-zero-day-webpagetest.md)[E3](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-discovering-a-zero-day-and-getting-code-execution-on-mozillas-aws-network.md)[E1](https://bugbountylibrary.com/r/blog%3Arapid7-com-blog-post-ra-rapid7-analysis-unauthenticated-file-upload-to-rce-in-beyondtrust-remote-support-cve-2026-102764.md)

## Where it shows up
- Bootstrap/common code that assigns `$_SERVER['REMOTE_ADDR']` from a header like `HTTP_FASTLY_CLIENT_IP` or `HTTP_X_FORWARDED_FOR` [E2](https://bugbountylibrary.com/r/blog%3Ablog-assetnote-io-bug-bounty-2019-03-19-rce-on-mozilla-zero-day-webpagetest.md)[E3](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-discovering-a-zero-day-and-getting-code-execution-on-mozillas-aws-network.md)
- `127.0.0.1` / localhost-only guards on sensitive actions (upload, admin, internal fetch) [E2](https://bugbountylibrary.com/r/blog%3Ablog-assetnote-io-bug-bounty-2019-03-19-rce-on-mozilla-zero-day-webpagetest.md)[E3](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-discovering-a-zero-day-and-getting-code-execution-on-mozillas-aws-network.md)
- Broker/router code with both an anti-spoof check and a separate "is this local" predicate [E1](https://bugbountylibrary.com/r/blog%3Arapid7-com-blog-post-ra-rapid7-analysis-unauthenticated-file-upload-to-rce-in-beyondtrust-remote-support-cve-2026-102764.md)
- Reserved aliases (router ID 1) accepted by the local predicate but not covered by the spoof check [E1](https://bugbountylibrary.com/r/blog%3Arapid7-com-blog-post-ra-rapid7-analysis-unauthenticated-file-upload-to-rce-in-beyondtrust-remote-support-cve-2026-102764.md)
- Rate-limit or admin gates that read a client-IP header without trusted-proxy validation

## How to review
Find every place client identity is derived. The invariant: a client-supplied header may only influence the address after the request is proven to come from a trusted proxy, and the trusted proxy must overwrite (not append to) the header. Check:
- Does any code path set REMOTE_ADDR (or equivalent) from a request header? Is that path gated on a verified proxy source? [E2](https://bugbountylibrary.com/r/blog%3Ablog-assetnote-io-bug-bounty-2019-03-19-rce-on-mozilla-zero-day-webpagetest.md)[E3](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-discovering-a-zero-day-and-getting-code-execution-on-mozillas-aws-network.md)
- For each localhost/admin check, trace what value it actually compares against and whether an attacker can set it.
- In routers/brokers, compare the anti-spoof check against the local-address predicate: does every alias the predicate accepts also get its real ID verified? [E1](https://bugbountylibrary.com/r/blog%3Arapid7-com-blog-post-ra-rapid7-analysis-unauthenticated-file-upload-to-rce-in-beyondtrust-remote-support-cve-2026-102764.md)
- Is the service directly reachable, bypassing the proxy that would sanitize the header?

## How finders spotted it
- Assetnote Continuous Security flagged unauthenticated WebPageTest instances on the target's attack surface; source review of workdone.php showed zip extraction plus a 127.0.0.1 check, then common.inc revealed the Fastly-Client-IP override that defeats it [E2](https://bugbountylibrary.com/r/blog%3Ablog-assetnote-io-bug-bounty-2019-03-19-rce-on-mozilla-zero-day-webpagetest.md)[E3](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-discovering-a-zero-day-and-getting-code-execution-on-mozillas-aws-network.md)
- Noticed SecureDir deletes executable files only after extraction, implying a race window [E2](https://bugbountylibrary.com/r/blog%3Ablog-assetnote-io-bug-bounty-2019-03-19-rce-on-mozilla-zero-day-webpagetest.md)[E3](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-discovering-a-zero-day-and-getting-code-execution-on-mozillas-aws-network.md)
- Reverse-engineered brain and thin-scc in Ghidra; saw the anti-spoof check compares only the actual router ID while the local-address predicate returns true for reserved router 1 without that comparison, and thin-scc feeds the message sender into that predicate [E1](https://bugbountylibrary.com/r/blog%3Arapid7-com-blog-post-ra-rapid7-analysis-unauthenticated-file-upload-to-rce-in-beyondtrust-remote-support-cve-2026-102764.md)
- Confirmed by sending the same request under ordinary vs router-1 source: only the forged one reached the file service [E1](https://bugbountylibrary.com/r/blog%3Arapid7-com-blog-post-ra-rapid7-analysis-unauthenticated-file-upload-to-rce-in-beyondtrust-remote-support-cve-2026-102764.md)

## Variants seen
- HTTP header overwriting REMOTE_ADDR to bypass a loopback check [E2](https://bugbountylibrary.com/r/blog%3Ablog-assetnote-io-bug-bounty-2019-03-19-rce-on-mozilla-zero-day-webpagetest.md)[E3](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-discovering-a-zero-day-and-getting-code-execution-on-mozillas-aws-network.md)
- Protocol-level sender/router-ID field trusted by a broker's local predicate [E1](https://bugbountylibrary.com/r/blog%3Arapid7-com-blog-post-ra-rapid7-analysis-unauthenticated-file-upload-to-rce-in-beyondtrust-remote-support-cve-2026-102764.md)

## Impact and severity
In both cases the spoofed identity unlocked a privileged path leading to remote code execution: header spoof plus a zip-extraction race gave PHP execution on Mozilla AWS [E2](https://bugbountylibrary.com/r/blog%3Ablog-assetnote-io-bug-bounty-2019-03-19-rce-on-mozilla-zero-day-webpagetest.md)[E3](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-discovering-a-zero-day-and-getting-code-execution-on-mozillas-aws-network.md); forged router ID reached a native file service to write PHP into the document root [E1](https://bugbountylibrary.com/r/blog%3Arapid7-com-blog-post-ra-rapid7-analysis-unauthenticated-file-upload-to-rce-in-beyondtrust-remote-support-cve-2026-102764.md). Severity is high because the check is the only barrier to an unauthenticated RCE chain; impact rises when combined with a second weakness (race window, extensionless-URL rewrite bypassing .htaccess) [E1](https://bugbountylibrary.com/r/blog%3Arapid7-com-blog-post-ra-rapid7-analysis-unauthenticated-file-upload-to-rce-in-beyondtrust-remote-support-cve-2026-102764.md)[E2](https://bugbountylibrary.com/r/blog%3Ablog-assetnote-io-bug-bounty-2019-03-19-rce-on-mozilla-zero-day-webpagetest.md)[E3](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-discovering-a-zero-day-and-getting-code-execution-on-mozillas-aws-network.md).

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **BeyondTrust Remote Support** (brain message router and thin-scc worker) 24.1.2, build 1524046, revision 4208-ddcf90715106aa0c0e19c10: Rapid7 Analysis: Unauthenticated File Upload to RCE in BeyondTrust Remote Support (CVE-2026-102764) (CVE-2026-102764). Report: https://bugbountylibrary.com/r/blog%3Arapid7-com-blog-post-ra-rapid7-analysis-unauthenticated-file-upload-to-rce-in-beyondtrust-remote-support-cve-2026-102764.md
- **Web Page Test** (workdone.php, common.inc) (version not stated): Discovering a zero day and getting code execution on Mozilla's AWS Network. Report: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-discovering-a-zero-day-and-getting-code-execution-on-mozillas-aws-network.md

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Arapid7-com-blog-post-ra-rapid7-analysis-unauthenticated-file-upload-to-rce-in-beyondtrust-remote-support-cve-2026-102764.md
- E2: https://bugbountylibrary.com/r/blog%3Ablog-assetnote-io-bug-bounty-2019-03-19-rce-on-mozilla-zero-day-webpagetest.md
- E3: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-discovering-a-zero-day-and-getting-code-execution-on-mozillas-aws-network.md