VYPR
← All advisories
High severity7.5NVD Advisory· Published Jan 23, 2017· Updated May 13, 2026

CVE-2016-4793

CVE-2016-4793

Description

The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
cakephp/cakephpPackagist
>= 1.2.0, < 2.6.132.6.13
cakephp/cakephpPackagist
>= 2.7.0-rc1, < 2.7.112.7.11
cakephp/cakephpPackagist
>= 2.8.0-rc1, < 2.8.22.8.2
cakephp/cakephpPackagist
>= 3.0.0-rc1, < 3.0.173.0.17
cakephp/cakephpPackagist
>= 3.1.0-beta1, < 3.1.123.1.12
cakephp/cakephpPackagist
>= 3.2.0-rc1, < 3.2.53.2.5

Affected products

1
  • Cakephp/Cakephp
    cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:*
    Range: <=3.2.4

Patches

1
908754649f70

Don't trust Client-IP header unless behind a proxy

https://github.com/cakephp/cakephpMark StoryMar 11, 2016via ghsa
commit
2 files changed · +9 −18
  • src/Network/Request.php+3 −12 modified
    @@ -523,21 +523,12 @@ public function clientIp()
     {
         if ($this->trustProxy && $this->env('HTTP_X_FORWARDED_FOR')) {
             $ipaddr = preg_replace('/(?:,.*)/', '', $this->env('HTTP_X_FORWARDED_FOR'));
+        } elseif ($this->trustProxy && $this->env('HTTP_CLIENT_IP')) {
+            $ipaddr = $this->env('HTTP_CLIENT_IP');
         } else {
-            if ($this->env('HTTP_CLIENT_IP')) {
-                $ipaddr = $this->env('HTTP_CLIENT_IP');
-            } else {
-                $ipaddr = $this->env('REMOTE_ADDR');
-            }
+            $ipaddr = $this->env('REMOTE_ADDR');
         }
 
-        if ($this->env('HTTP_CLIENTADDRESS')) {
-            $tmpipaddr = $this->env('HTTP_CLIENTADDRESS');
-
-            if (!empty($tmpipaddr)) {
-                $ipaddr = preg_replace('/(?:,.*)/', '', $tmpipaddr);
-            }
-        }
         return trim($ipaddr);
     }
  • tests/TestCase/Network/RequestTest.php+6 −6 modified
    @@ -528,7 +528,7 @@ public function testDefaultEnvValue()
      *
      * @return void
      */
-    public function testclientIp()
+    public function testClientIp()
     {
         $request = new Request(['environment' => [
             'HTTP_X_FORWARDED_FOR' => '192.168.1.5, 10.0.1.1, proxy.com',
@@ -539,17 +539,17 @@ public function testclientIp()
         $request->trustProxy = true;
         $this->assertEquals('192.168.1.5', $request->clientIp());
 
-        $request->trustProxy = false;
+        $request->env('HTTP_X_FORWARDED_FOR', '');
         $this->assertEquals('192.168.1.2', $request->clientIp());
 
+        $request->trustProxy = false;
+        $this->assertEquals('192.168.1.3', $request->clientIp());
+
         $request->env('HTTP_X_FORWARDED_FOR', '');
-        $this->assertEquals('192.168.1.2', $request->clientIp());
+        $this->assertEquals('192.168.1.3', $request->clientIp());
 
         $request->env('HTTP_CLIENT_IP', '');
         $this->assertEquals('192.168.1.3', $request->clientIp());
-
-        $request->env('HTTP_CLIENTADDRESS', '10.0.1.2, 10.0.1.1');
-        $this->assertEquals('10.0.1.2', $request->clientIp());
     }
 
     /**

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

9

News mentions

0

No linked articles in our index yet.