CVE-2025-46814: FastAPI Guard Auth Bypass Vulnerability

CVE-2025-46814 Overview

CVE-2025-46814 is an HTTP header injection vulnerability affecting FastAPI Guard, a security library for FastAPI that provides middleware to control IPs, log requests, and detect penetration attempts. By manipulating the X-Forwarded-For header, an attacker can potentially inject arbitrary IP addresses into the request. This vulnerability can allow attackers to bypass IP-based access controls, mislead logging systems, and impersonate trusted clients.

Critical Impact

This vulnerability enables attackers to bypass IP-based authentication and authorization controls by injecting arbitrary IP addresses via the X-Forwarded-For header, potentially gaining unauthorized access to protected resources.

Affected Products

• FastAPI Guard versions prior to 2.0.0
• Applications relying on X-Forwarded-For header for IP-based authorization
• FastAPI applications using fastapi_guard middleware for access control

Discovery Timeline

• 2025-05-06 - CVE-2025-46814 published to NVD
• 2025-12-31 - Last updated in NVD database

Technical Details for CVE-2025-46814

Vulnerability Analysis

This HTTP header injection vulnerability (CWE-74) exists in FastAPI Guard's handling of the X-Forwarded-For HTTP header. The vulnerability allows network-based attacks without requiring user interaction or special privileges. The primary impact is on the integrity of IP-based access controls, as attackers can manipulate the perceived client IP address.

When FastAPI Guard processes incoming requests, it trusts the X-Forwarded-For header value without proper validation, allowing malicious actors to inject arbitrary IP addresses. This is particularly dangerous in environments where IP whitelisting is used for authentication or authorization decisions.

Root Cause

The root cause of this vulnerability stems from improper input validation of the X-Forwarded-For header. Prior to version 2.0.0, the FastAPI Guard middleware did not properly validate or sanitize IP addresses extracted from client-supplied headers. The fix introduced proper IP address validation using Python's ipaddress module, specifically adding IPv4Address and ip_network imports to validate incoming IP addresses.

Attack Vector

The attack vector is network-based, requiring no authentication and no user interaction. An attacker can exploit this vulnerability by crafting HTTP requests with malicious X-Forwarded-For header values. The attack is especially impactful when:

• The application uses IP-based allowlisting or blocklisting
• Logging systems rely on the extracted IP for audit trails
• Rate limiting is implemented based on client IP addresses
• Trusted internal networks are granted elevated privileges based on IP

# Security patch in guard/middleware.py showing the fix
# Source: https://github.com/rennf93/fastapi-guard/commit/0b003fda4c678c1b514e95f319aee88113e9bf4b

 import logging
 import time
 from collections.abc import Awaitable, Callable
+from ipaddress import IPv4Address, ip_network
 
 from fastapi import FastAPI, Request, Response, status
 from fastapi.middleware.cors import CORSMiddleware

The patch adds proper IP address validation using Python's ipaddress module to validate that X-Forwarded-For header values contain legitimate IP addresses rather than arbitrary injected content.

Detection Methods for CVE-2025-46814

Indicators of Compromise

• Unusual or malformed IP addresses appearing in application logs from X-Forwarded-For headers
• Multiple requests from different source IPs claiming the same X-Forwarded-For value
• Access from external networks using internal/trusted IP ranges in X-Forwarded-For
• Requests with excessively long or malformed X-Forwarded-For header chains

Detection Strategies

• Implement log analysis rules to detect discrepancies between actual source IP and X-Forwarded-For values
• Monitor for requests containing reserved or private IP ranges in X-Forwarded-For from external sources
• Deploy Web Application Firewall (WAF) rules to validate X-Forwarded-For header formats
• Create alerts for sudden changes in IP-based access patterns

Monitoring Recommendations

• Enable detailed HTTP header logging for all requests processed by FastAPI Guard
• Monitor application access logs for IP spoofing patterns, especially access to protected endpoints
• Implement anomaly detection for IP-based authentication and authorization systems
• Review audit logs regularly for signs of access control bypass attempts

How to Mitigate CVE-2025-46814

Immediate Actions Required

• Upgrade FastAPI Guard to version 2.0.0 or later immediately
• Review application logs for any historical evidence of exploitation
• Audit IP-based access control configurations and verify their effectiveness
• Consider implementing additional authentication mechanisms beyond IP-based controls

Patch Information

The vulnerability has been fixed in FastAPI Guard version 2.0.0. The security patch introduces proper IP address validation using Python's ipaddress module to ensure that only valid IP addresses are processed from the X-Forwarded-For header.

For detailed information about this vulnerability, refer to the GitHub Security Advisory GHSA-77q8-qmj7-x7pp.

Workarounds

• If upgrading immediately is not possible, implement upstream proxy configuration to strip or validate X-Forwarded-For headers before they reach the application
• Configure reverse proxies (nginx, Apache, etc.) to set trusted X-Forwarded-For values and ignore client-supplied headers
• Implement application-level validation of IP addresses before using them for access control decisions

# Example nginx configuration to set trusted X-Forwarded-For
# Place in nginx server or location block

# Clear any existing X-Forwarded-For from client
proxy_set_header X-Forwarded-For $remote_addr;

# Or for multi-proxy setups, append only the direct client IP
# proxy_set_header X-Forwarded-For "$proxy_add_x_forwarded_for";