CVE-2025-48865

Published May 30, 2025

Last updated a year ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-48865 is a vulnerability found in Fabio, an HTTP(S) and TCP router used for deploying applications managed by Consul, affecting versions prior to 1.6.6. The flaw lies in how Fabio processes hop-by-hop headers within HTTP requests. An attacker can exploit this by manipulating the HTTP `Connection` header, designating specific `X-Forwarded` headers (such as `X-Forwarded-Host`, `X-Forwarded-Port`, `X-Forwarded-Proto`, `X-Real-Ip`, and `Forwarded`) as hop-by-hop. This manipulation causes Fabio to strip these headers from the request before forwarding it to the backend application. Backend applications typically rely on these `X-Forwarded` headers for various operations, including determining the origin of a request. The removal of these headers can lead to confusion regarding the true source of the request and may impact how backend applications handle access control. The vulnerability has been addressed in Fabio version 1.6.6, with the fix involving filtering the `Connection` header to prevent the unintended removal of protected headers.

Description: Fabio is an HTTP(S) and TCP router for deploying applications managed by consul. Prior to version 1.6.6, Fabio allows clients to remove X-Forwarded headers (except X-Forwarded-For) due to a vulnerability in how it processes hop-by-hop headers. Fabio adds HTTP headers like X-Forwarded-Host and X-Forwarded-Port when routing requests to backend applications. Since the receiving application should trust these headers, allowing HTTP clients to remove or modify them creates potential security vulnerabilities. Some of these custom headers can be removed and, in certain cases, manipulated. The attack relies on the behavior that headers can be defined as hop-by-hop via the HTTP Connection header. This issue has been patched in version 1.6.6.
Source: security-advisories@github.com
NVD status: Analyzed
Products: fabio

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.1
Impact score: 5.2
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Severity: CRITICAL

Weaknesses

security-advisories@github.com: CWE-345
nvd@nist.gov: CWE-345

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:fabiolb:fabio:*:*:*:*:*:go:*:*",
            "matchCriteriaId": "6A945EFC-B582-43E7-A382-9EE8DFF03511",
            "versionEndExcluding": "1.6.6",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.