CVE-2023-44463

Description

An issue in pretix before version 2023.7.1 allows IP address spoofing due to incorrect parsing of configuration files. The application trusts X-Forwarded-For, X-Forwarded-Host, and X-Forwarded-Proto headers even when the corresponding settings are explicitly set to off in the pretix.cfg file. The headers are only ignored if the configuration flags are absent entirely, meaning any presence of the flags—regardless of their value—causes the headers to be honored [1][4].

Exploitation

To exploit this vulnerability, an attacker must control the X-Forwarded-For header sent to the pretix application. This occurs when the reverse proxy configuration allows user-supplied headers to pass through without validation or stripping. The impact is amplified if an administrator has explicitly disabled the trust_x_forwarded_for setting with the intention of relying solely on the proxy for IP identification, yet the bug still treats the header as trusted [4].

Impact

Successfully spoofing the IP address allows an attacker to bypass IP-based rate limiting mechanisms within pretix. While pretix does not use the IP address for access control, some rate-limiting features depend on it. A higher impact could be possible if additional external access controls rely on host names or IP addresses derived from these headers [4].

Mitigation

The vulnerability is fixed in pretix versions 2023.7.1, 2023.6.1, and 4.20.2 [2][4]. Users of self-hosted pretix installations are strongly recommended to update immediately. Customers of the hosted pretix service are not affected. As a workaround, administrators should ensure reverse proxies are configured to remove or override untrusted X-Forwarded-* headers.