CVE-2024-44930: Serilog.Enrichers.ClientInfo - Client IP Spoofing vulnerability
Summary
CVE-2024-44930: Serilog Client IP Spoofing vulnerability. Affects Serilog.Enrichers.ClientInfo versions < 2.1.0. Fixed in 2.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Serilog.Enrichers.ClientInfo is a NuGet package that provides client IP information enrichment for Serilog logging library. It allows developers to include client IP addresses in log files, which can be useful for tracking and analyzing user activity. However, versions before 2.1.0 are vulnerable to a Client IP Spoofing vulnerability. This vulnerability enables attackers to manipulate their IP addresses in log files by specifying arbitrary values in the X-Forwarded-For or Client-Ip headers during HTTP requests. Unfortunately, it is not possible to configure Serilog.Enrichers.ClientInfo to disregard the X-Forwarded-For header.
Vulnerability Detail
The Client IP Spoofing vulnerability in Serilog.Enrichers.ClientInfo allows attackers to falsify their IP addresses in log files. By providing a custom IP address in the X-Forwarded-For or Client-Ip headers, an attacker can deceive the logging system into recording the spoofed IP address as the client's actual IP. This can lead to misattributed or inaccurate log data, potentially impacting security investigations, user tracking, and analysis. The vulnerability has a CVSS score of 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
How To Fix
Minimum fixed version
2.1.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version (2.1.0) of Serilog.Enrichers.ClientInfo to mitigate the risk of IP address spoofing in log files.
Conclusion
Serilog.Enrichers.ClientInfo versions before 2.1.0 are vulnerable to a Client IP Spoofing vulnerability. Attackers can manipulate their IP addresses in log files by providing arbitrary values in the X-Forwarded-For or Client-Ip headers. To mitigate this vulnerability, it is crucial to upgrade to version 2.1.0 or later of Serilog.Enrichers.ClientInfo. No workarounds are available for this issue.
See every vulnerability recorded for Serilog.Enrichers.ClientInfo →
FAQ
Serilog.Enrichers.ClientInfo is a NuGet package that provides client IP information enrichment for Serilog logging library. It allows developers to include client IP addresses in log files for analysis and tracking purposes.
The Client IP Spoofing vulnerability allows attackers to manipulate their IP addresses in log files, leading to misattributed or inaccurate log data. This can impact security investigations, user tracking, and analysis.
No, the X-Forwarded-For header can be easily manipulated by attackers, allowing them to spoof their IP addresses in log files.
Yes, upgrading Serilog.Enrichers.ClientInfo to version 2.1.0 or later fixes the Client IP Spoofing vulnerability.
No, there are no known workarounds for this vulnerability. Upgrading to the fixed version is the recommended solution.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
