CVE-2025-10929: Reverse Proxy Header Input Vulnerability

CVE-2025-10929 Overview

CVE-2025-10929 is an Improper Validation of Consistency within Input vulnerability [CWE-1288] in the Drupal Reverse Proxy Header contributed module. The flaw allows remote attackers to manipulate user-controlled variables by supplying crafted HTTP headers that the module trusts without proper validation. The issue affects Reverse Proxy Header versions from 0.0.0 before 1.1.2. Drupal published advisory SA-CONTRIB-2025-111 covering this issue. The vulnerability requires no authentication and no user interaction, and it can be exploited over the network with low complexity.

Critical Impact
Attackers can send spoofed reverse proxy headers to influence trusted variables inside Drupal, potentially disrupting availability of application logic that depends on client IP or proxy metadata.

Affected Products

Drupal Reverse Proxy Header module versions 0.0.0 through 1.1.1
Drupal sites running the Reverse Proxy Header contributed module
Environments where Drupal sits behind a reverse proxy or load balancer using this module

Discovery Timeline

2025-10-30 - CVE-2025-10929 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10929

Vulnerability Analysis

The Reverse Proxy Header module extends Drupal's ability to identify a client's real IP address when the site sits behind a reverse proxy. It reads HTTP headers such as X-Forwarded-For or a custom-configured header and populates internal variables used across Drupal for logging, access decisions, and rate limiting. The module fails to consistently validate that incoming header values originate from a trusted upstream proxy. As a result, an unauthenticated attacker can inject arbitrary values into these user-controlled variables by sending crafted requests directly to the application. The impact is limited to availability disruption, but the attack surface is broad because any exposed Drupal endpoint may accept the malicious headers.

Root Cause

The root cause is Improper Validation of Consistency within Input [CWE-1288]. The module accepts header data without cross-checking it against the trusted proxy chain or the source address of the request. Because the module does not enforce consistency between the declared client identity and the actual TCP peer, attacker-supplied header values are treated as authoritative.

Attack Vector

Exploitation occurs over the network by sending HTTP requests with forged proxy headers. No credentials or user interaction are required. An attacker crafts a request containing spoofed values in the header the module is configured to trust. Drupal then uses those values in downstream logic, allowing manipulation of variables such as the perceived client IP. This can be used to bypass IP-based restrictions, poison logs, or trigger conditions that degrade service availability. Refer to the Drupal Security Advisory for authoritative technical details.

Detection Methods for CVE-2025-10929

Indicators of Compromise

HTTP requests containing reverse proxy headers such as X-Forwarded-For, X-Real-IP, or custom-configured headers arriving from source IPs outside the known proxy fleet.
Log entries showing client IP values inconsistent with the observed TCP peer or the site's upstream infrastructure.
Sudden spikes in requests targeting endpoints that enforce IP-based access control or rate limiting.

Detection Strategies

Compare the client IP reported by Drupal with the actual TCP source IP recorded at the load balancer or web server layer, and alert on mismatches from untrusted networks.
Monitor web server access logs for reverse proxy headers arriving on connections that did not traverse an approved proxy.
Review Drupal watchdog and access logs for authentication or authorization events tied to unexpected client IP addresses.

Monitoring Recommendations

Enable verbose logging on the reverse proxy tier and forward it to a centralized SIEM for correlation with Drupal application logs.
Baseline expected proxy header patterns and alert on deviations, including unusual header casing, duplicated headers, or values from non-routable ranges.
Track version inventory of the Reverse Proxy Header module across all Drupal sites to identify hosts still running versions prior to 1.1.2.

How to Mitigate CVE-2025-10929

Immediate Actions Required

Upgrade the Drupal Reverse Proxy Header module to version 1.1.2 or later on all affected sites.
Restrict acceptance of reverse proxy headers at the web server or load balancer so only trusted upstream proxies can set them.
Audit module configuration to confirm the trusted proxy list is explicitly defined and does not default to permissive values.

Patch Information

The maintainers released Reverse Proxy Header 1.1.2, which addresses the improper input consistency validation. Details are available in the Drupal Security Advisory SA-CONTRIB-2025-111. Apply the update through Drupal's standard module update workflow and clear caches after deployment.

Workarounds

Strip or overwrite reverse proxy headers at the edge for any request that did not originate from an approved proxy.
Temporarily disable the Reverse Proxy Header module if the upgrade cannot be applied immediately and the site can tolerate the loss of client IP fidelity.
Enforce network-level access controls that prevent direct client access to Drupal application servers, forcing all traffic through the trusted proxy tier.

bash

# Example nginx configuration to overwrite untrusted proxy headers
set_real_ip_from 10.0.0.0/24;      # trusted proxy subnet
real_ip_header X-Forwarded-For;
real_ip_recursive on;

# Reject or clear headers from untrusted sources
map $remote_addr $trusted_proxy {
    default 0;
    10.0.0.0/24 1;
}

server {
    if ($trusted_proxy = 0) {
        proxy_set_header X-Forwarded-For "";
        proxy_set_header X-Real-IP $remote_addr;
    }
}