Improper Access Control in MegaEase EaseProbe

MegaEase EaseProbe versions up to 2.3.0 contain an improper access control vulnerability located within the realIP function of web/server.go. This vulnerability allows a remote, unauthenticated attacker to manipulate specific HTTP request headers - namely X-Forwarded-For, X-Real-IP, and True-Client-IP - to bypass established access control policies. By spoofing these headers, an attacker can trick the application into incorrectly identifying the source IP address of the request. Since the vendor has not responded to disclosure efforts and public exploit code exists, organizations utilizing EaseProbe as a monitoring or middleware tool are at high risk of unauthorized access to administrative functions or protected resources.

Impact

Successful exploitation allows remote attackers to circumvent security policies and access protected application features without proper authorization. This can lead to unauthorized configuration changes, data exposure, or full compromise of the EaseProbe monitoring instance. The vulnerability affects all users of EaseProbe version 2.3.0 and earlier.

Recommendation

• Implement network-level restrictions or a Web Application Firewall (WAF) to inspect and sanitize X-Forwarded-For, X-Real-IP, and True-Client-IP headers for traffic destined to EaseProbe instances.
• Monitor web server logs for suspicious header manipulation patterns, such as unexpected IP addresses or anomalous patterns in requests to administrative endpoints.
• Restrict access to the EaseProbe management interface to trusted internal networks or via VPN until a vendor-supplied patch is available.