in a certain page I have a newsletter subscription form, where the user enters his e-mail address and then through PHP an authenticated e-mail is sent to myself with the user's information (e-mail address he declared, IP address, Hostname, UA, timestamp).
Yesterday someone was spamming this function by making hundreds of requests. I implemented a per IP max request restriction.
The problem is: This person sent a request on this subscription form, where the appearing IP address is 127.0.0.1 (localhost). This was startling to me, my first thought was: "did he have access to the server? Was the server compromised?"
This is the email as viewed in the mail client:
And this is the source of the email (renamed hostnames and IPs for obvious reasons):
From - Thu Dec 3 00:56:04 2020
X-Account-Key: account13
X-UIDL: 00017d054e27f872
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys: $label1
Return-Path: <xxx@mydomain.com>
Delivered-To: xxx@mydomain.com
Received: from dir1.myisp.com ([88.88.88.88])
by pop1.myisp.com (Dovecot) with LMTP id E6xiJ4+0x1/NOwAAymMqcQ
for <xxx@mydomain.com>; Wed, 02 Dec 2020 17:36:47 +0200
Received: from corv.myisp.com ([88.88.88.88])
by dir1.myisp.com with LMTP id uA5OJ4+0x1/6RQAAAftgaQ
; Wed, 02 Dec 2020 17:36:47 +0200
Received: from localhost (localhost [127.0.0.1])
by corv.myisp.com (ESMTP) with ESMTP id BEB3A15BBE6
for <xxx@mydomain.com>; Wed, 2 Dec 2020 17:36:18 +0200 (EET)
Received: from corv.myisp.com ([127.0.0.1])
by localhost (corv.myisp.com [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id SSQN6kaeD1p5 for <xxx@mydomain.com>;
Wed, 2 Dec 2020 17:36:18 +0200 (EET)
Received: from ech.myisp.com (smtp.myisp.com [44.44.44.44])
by corv.myisp.com (ESMTP) with ESMTPS
for <xxx@mydomain.com>; Wed, 2 Dec 2020 17:36:18 +0200 (EET)
X-Amavis-Alert: BAD HEADER SECTION, Missing required header field: "Date"
Received: from localhost (myserver.host.com [55.55.55.55])
(Authenticated sender: xxx@mydomain.com)
by ech.myisp.com (ESMTP) with ESMTPSA
for <xxx@mydomain.com>; Wed, 2 Dec 2020 17:36:18 +0200 (EET)
From: xxx@mydomain.com
To: xxx@mydomain.com
Content-Type: text/html; charset=UTF-8
X-Mailer: PHP/7.4.13
Reply-To: xxx@mydomain.com
Subject: blablabla
E-mail: blablabla
So other than the server being compromised, which doesn't seem so, I'm looking into other options. This is how the PHP script that sends the newsletter mail, gets the IP address
function getIp()
{if(isset($_SERVER['HTTP_X_FORWARDED_FOR'])){
$ip_address=$_SERVER['HTTP_X_FORWARDED_FOR'];
}
if (!isset($ip_address)){
if (isset($_SERVER['REMOTE_ADDR']))
$ip_address=$_SERVER['REMOTE_ADDR'];
}
return $ip_address;
}
So my most obvious answer is: he just spoofed the HTTP_X_FORWARDED_FOR header, which is easy to do.
But what I'm looking for, is: would there be a away for an attacker to abuse some existing php page into submitting a request to the newsletter.php script? (I'm not running any CMS, just pretty simple PHP scripts). If the answer is yes, what would be probable culprits as in bad practices in such PHP scripts that allow POST-ing requests to arbitrary other PHP scripts and the IP address being that of the server?
Also, is there anything else I might have not thought of?
Thank you in advance for your help.