CVE-2025-66570: Cpp-httplib Auth Bypass Vulnerability

CVE-2025-66570 Overview

CVE-2025-66570 is a critical authentication bypass vulnerability in cpp-httplib, a popular C++11 single-file header-only cross-platform HTTP/HTTPS library. The vulnerability allows attackers to inject HTTP headers that shadow internal server metadata, enabling IP spoofing, log poisoning, and authorization bypass through header shadowing techniques.

Prior to version 0.27.0, the library improperly handles attacker-controlled HTTP headers named REMOTE_ADDR, REMOTE_PORT, LOCAL_ADDR, and LOCAL_PORT. These headers are parsed into the request header multimap via read_headers() in httplib.h before the server appends its own internal metadata using the same header names without erasing duplicates. Because Request::get_header_value returns the first entry for a header key, downstream code may inadvertently use attacker-controlled values instead of legitimate server-generated metadata.

Critical Impact

Attackers can bypass IP-based authorization controls, spoof client IP addresses in logs, and manipulate server-visible metadata through malicious HTTP header injection without authentication.

Affected Products

• yhirose cpp-httplib versions prior to 0.27.0

Discovery Timeline

• 2025-12-05 - CVE CVE-2025-66570 published to NVD
• 2025-12-10 - Last updated in NVD database

Technical Details for CVE-2025-66570

Vulnerability Analysis

This vulnerability stems from an authentication spoofing weakness (CWE-290) in how cpp-httplib processes incoming HTTP headers. The library's header parsing mechanism in httplib.h uses headers.emplace() to store all incoming headers into a multimap data structure. Subsequently, the server's Server::process_request function appends its own internal metadata headers using the same key names without first clearing any existing entries.

The critical flaw lies in the Request::get_header_value function, which by default returns the first entry for any given header key (when id == 0). Since client-supplied headers are parsed before server-inserted headers, an attacker can shadow the legitimate server-generated values with malicious data.

This vulnerability affects multiple code paths including get_client_ip, nginx_access_logger, and nginx_error_logger functions in the docker example code, demonstrating how downstream code relying on these header values for logging, access control, or client identification can be compromised.

Root Cause

The root cause is insufficient input validation and improper handling of duplicate HTTP headers in the multimap data structure. The library fails to sanitize or reject client-supplied headers that use reserved internal metadata names, and the server appends rather than overwrites its own values, creating a header shadowing condition where attacker-controlled values take precedence.

Attack Vector

An attacker can exploit this vulnerability remotely over the network by crafting HTTP requests containing malicious headers with names matching the server's internal metadata fields. The attack requires no authentication and can be executed with low complexity.

The attack flow involves:

1. Attacker sends an HTTP request with injected headers such as REMOTE_ADDR: 127.0.0.1 or LOCAL_ADDR: 10.0.0.1
2. The read_headers() function parses these into the request header multimap
3. Server subsequently appends legitimate values using the same header names
4. Downstream code calling get_header_value() retrieves the attacker's values instead of server-generated metadata
5. Authorization decisions, logging, and other security-sensitive operations use spoofed data

   Server &
   set_header_writer(std::function<ssize_t(Stream &, Headers &)> const &writer);
 
+  Server &set_trusted_proxies(const std::vector<std::string> &proxies);
+
   Server &set_keep_alive_max_count(size_t count);
   Server &set_keep_alive_timeout(time_t sec);

Source: GitHub Commit ac9ebb0e

The patch introduces a set_trusted_proxies() method that allows administrators to explicitly define trusted proxy sources, preventing unauthorized header injection from untrusted clients.

Detection Methods for CVE-2025-66570

Indicators of Compromise

• HTTP requests containing REMOTE_ADDR, REMOTE_PORT, LOCAL_ADDR, or LOCAL_PORT headers from external sources
• Log entries showing internal IP addresses (e.g., 127.0.0.1, 10.x.x.x, 192.168.x.x) from external network requests
• Inconsistencies between logged client IPs and actual network traffic source addresses
• Authorization bypass events where IP-restricted resources are accessed from unexpected addresses

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block HTTP requests containing reserved internal metadata header names
• Deploy network intrusion detection signatures to identify header injection attempts targeting cpp-httplib servers
• Monitor application logs for IP address anomalies where logged source IPs don't match network layer information
• Enable detailed HTTP header logging at reverse proxy or load balancer level to identify suspicious header patterns

Monitoring Recommendations

• Configure SIEM alerts for authentication events originating from localhost or internal IP ranges that should only be external traffic
• Implement log correlation between network-level connection data and application-level client IP logging to detect spoofing
• Monitor for increased failed authorization attempts followed by successful bypasses from similar request patterns
• Review access logs for requests containing unusual or duplicate header patterns indicating injection attempts

How to Mitigate CVE-2025-66570

Immediate Actions Required

• Upgrade cpp-httplib to version 0.27.0 or later immediately
• Audit application code for any usage of REMOTE_ADDR, REMOTE_PORT, LOCAL_ADDR, or LOCAL_PORT headers in security-sensitive decisions
• Implement network-level filtering to strip suspicious headers from incoming requests before they reach the application
• Review access logs for signs of prior exploitation attempts

Patch Information

The vulnerability has been fixed in cpp-httplib version 0.27.0. The patch introduces a set_trusted_proxies() function that allows explicit configuration of trusted proxy sources, ensuring that internal metadata headers are only accepted from authorized sources. Users should update to this version or apply the security commit referenced in the GitHub Security Advisory GHSA-xm2j-vfr9-mg9m.

Workarounds

• Deploy a reverse proxy or WAF in front of cpp-httplib applications to filter out requests containing REMOTE_ADDR, REMOTE_PORT, LOCAL_ADDR, or LOCAL_PORT headers
• Implement application-level header validation to reject requests with these reserved header names from untrusted sources
• Use network segmentation to ensure that only trusted internal services can send requests to vulnerable endpoints
• Avoid relying solely on IP-based authorization; implement additional authentication mechanisms

# Example nginx configuration to strip dangerous headers
proxy_set_header REMOTE_ADDR "";
proxy_set_header REMOTE_PORT "";
proxy_set_header LOCAL_ADDR "";
proxy_set_header LOCAL_PORT "";
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;