php / email / iis

Question

in a certain page I have a newsletter subscription form, where the user enters his e-mail address and then through PHP an authenticated e-mail is sent to myself with the user's information (e-mail address he declared, IP address, Hostname, UA, timestamp).

Yesterday someone was spamming this function by making hundreds of requests. I implemented a per IP max request restriction.

The problem is: This person sent a request on this subscription form, where the appearing IP address is 127.0.0.1 (localhost). This was startling to me, my first thought was: "did he have access to the server? Was the server compromised?"

This is the email as viewed in the mail client:

And this is the source of the email (renamed hostnames and IPs for obvious reasons):

From - Thu Dec  3 00:56:04 2020
X-Account-Key: account13
X-UIDL: 00017d054e27f872
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys: $label1                                                                         
Return-Path: <xxx@mydomain.com>
Delivered-To: xxx@mydomain.com
Received: from dir1.myisp.com ([88.88.88.88])
    by pop1.myisp.com (Dovecot) with LMTP id E6xiJ4+0x1/NOwAAymMqcQ
    for <xxx@mydomain.com>; Wed, 02 Dec 2020 17:36:47 +0200
Received: from corv.myisp.com ([88.88.88.88])
    by dir1.myisp.com with LMTP id uA5OJ4+0x1/6RQAAAftgaQ
    ; Wed, 02 Dec 2020 17:36:47 +0200
Received: from localhost (localhost [127.0.0.1])
    by corv.myisp.com (ESMTP) with ESMTP id BEB3A15BBE6
    for <xxx@mydomain.com>; Wed,  2 Dec 2020 17:36:18 +0200 (EET)
Received: from corv.myisp.com ([127.0.0.1])
    by localhost (corv.myisp.com [127.0.0.1]) (amavisd-new, port 10024)
    with ESMTP id SSQN6kaeD1p5 for <xxx@mydomain.com>;
    Wed,  2 Dec 2020 17:36:18 +0200 (EET)
Received: from ech.myisp.com (smtp.myisp.com [44.44.44.44])
    by corv.myisp.com (ESMTP) with ESMTPS
    for <xxx@mydomain.com>; Wed,  2 Dec 2020 17:36:18 +0200 (EET)
X-Amavis-Alert: BAD HEADER SECTION, Missing required header field: "Date"
Received: from localhost (myserver.host.com [55.55.55.55])
    (Authenticated sender: xxx@mydomain.com)
    by ech.myisp.com (ESMTP) with ESMTPSA
    for <xxx@mydomain.com>; Wed,  2 Dec 2020 17:36:18 +0200 (EET)
From: xxx@mydomain.com
To: xxx@mydomain.com
Content-Type: text/html; charset=UTF-8
X-Mailer: PHP/7.4.13
Reply-To: xxx@mydomain.com
Subject: blablabla

E-mail: blablabla

So other than the server being compromised, which doesn't seem so, I'm looking into other options. This is how the PHP script that sends the newsletter mail, gets the IP address

function getIp()
{if(isset($_SERVER['HTTP_X_FORWARDED_FOR'])){
    $ip_address=$_SERVER['HTTP_X_FORWARDED_FOR'];
}

if (!isset($ip_address)){
        if (isset($_SERVER['REMOTE_ADDR'])) 
        $ip_address=$_SERVER['REMOTE_ADDR'];
}
return $ip_address;
}

So my most obvious answer is: he just spoofed the HTTP_X_FORWARDED_FOR header, which is easy to do.

But what I'm looking for, is: would there be a away for an attacker to abuse some existing php page into submitting a request to the newsletter.php script? (I'm not running any CMS, just pretty simple PHP scripts). If the answer is yes, what would be probable culprits as in bad practices in such PHP scripts that allow POST-ing requests to arbitrary other PHP scripts and the IP address being that of the server?

Also, is there anything else I might have not thought of?

Thank you in advance for your help.

Answer 1

No, your server probably wasn't compromised for this person to trick your function into thinking he was connecting from localhost. The problem actually lies in the code which records the clients IP.

Your getIP() function first tries to get the client's IP from $_SERVER['HTTP_X_FORWARDED_FOR']. The trouble with this is that HTTP_X_FORWARDED_FOR is a client controlled HTTP header. As a rule, never trust anything controlled completely by the client, since a malicious client can always spoof it to contain anything they want. In this case, the spammer probably just spoofed it to contain 127.0.0.1.

$_SERVER['REMOTE_ADDR'] on the other hand, reliably tells you the IP from which the server received the connection. The attacker could still use a proxy/VPN to hide their real IP (and there isn't any reliable way to prevent this), but they cannot make the connection appear to come from some impossible IP like localhost or an IP from a reserved range.