Fleet Rate Limiting Bypass Vulnerability via Unvalidated Client IP Headers

A vulnerability in Fleet device management software prior to version 4.80.1 allowed clients to spoof their IP addresses by manipulating HTTP headers such as X-Forwarded-For, X-Real-IP, and True-Client-IP. This exploitation could bypass per-IP rate limits, enhancing the effectiveness of brute-force or password-spraying attacks on authentication endpoints. The issue does not facilitate authentication bypass, privilege escalation, data exposure, or remote code execution on its own.

Impact

Exploitation of this vulnerability could lead to a bypass of per-IP rate limits, allowing for more effective brute-force or password-spraying attacks against authentication endpoints.

Remediation

Users can upgrade to Fleet version 4.80.1 or later, or run Fleet behind a trusted reverse proxy or load balancer that overwrites client IP headers.