Forwarded Headers Middleware: X-Forwarded-Prefix Applied when it comes from an Unknown Proxy

[yannic-hamann-abb]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

I am not understanding the security concerns why X-Forwarded-Fields should be only allowed for known proxies - but that is what the documentation implies.
The current implementation of ForwardedHeadersMiddleware only breaks and logs Unknown proxy: {RemoteIpAndPort} when the flag ForwardedHeaders.XForwardedFor is set.

Documentation says:

Address ranges of known networks to accept forwarded headers from.

With other words you can end up with a configuration like:

var options = new ForwardedHeadersOptions { ForwardedHeaders = ForwardedHeaders.XForwardedPrefix };

which modifies your request.PathBase even though it comes from an unknown proxy. Is this a bug or by design? If by design maybe documentation could be improved.
XForwardedProto and XForwardedHost are potentially bypassed in the same way.

Expected Behavior

Unknown due to my limited security understanding. Maybe HttpContext.Request.PathBase should be left untouched by the middleware when header comes from an unknown proxy.

Steps To Reproduce

var options = new ForwardedHeadersOptions { ForwardedHeaders = ForwardedHeaders.XForwardedPrefix };
// options.KnownNetworks.Add(new Microsoft.AspNetCore.HttpOverrides.IPNetwork(IPAddress.Parse("0.0.0.0"), 0));
_application.UseForwardedHeaders(options);

Exceptions (if any)

No response

.NET Version

9.0.104

Anything else?

I would like to contribute to fix this issue. I am planning to write some tests tomorrow for this and suggest a PR with some more detailed description of the issue.

[yannic-hamann-abb]

Proof that there is a bug and that XForwardedPrefix, XForwardedProto and XForwardedHost headers can be spoofed because the CheckKnownAddress method that determines if the headers can be trusted only kicks in when XForwardedFor is set: f0aa956.

---

I also cannot delete this issue. I contacted secure@microsoft.com to delete this issue. I think it is not a super critical security issue - and I wasn't really 100% sure if the headers can be spoofed when I created this.
But from reading a bit more this could even potentially qualify for a bug bounty 😂.
Anyhow, I am not frequently contributing to open source and it would make me happy and proud when I can commit a change to this repo that fixes this.

---

I would love to create the PR for my two commits, but I am unsure if I should do this bc it may be related to security, could someone guide me?