CyberRota Analysis
AI-GeneratedFileCodeBox versions prior to 2.4 are vulnerable to a rate-limit bypass due to improper verification of the X-Real-IP and X-Forwarded-For headers, allowing unauthenticated attackers to circumvent request throttling. This vulnerability enables attackers to enumerate share codes and access other users' files without authentication, posing a significant risk to user data privacy. Organizations using affected versions should prioritize patching to mitigate potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FileCodeBox before 2.4 contains a rate-limit bypass vulnerability in the IPRateLimit class that allows unauthenticated attackers to circumvent request throttling by supplying attacker-controlled X-Real-IP and X-Forwarded-For headers without verification of trusted reverse proxy origin. Attackers can supply unique spoofed IP values on each request to enumerate all possible share codes and retrieve other users' files without authentication.