CVE-2025-31135

Executive Summary

CVE-2025-31135 is a vulnerability in the Go-Guerrilla SMTP Daemon, a lightweight SMTP server written in Go. The flaw allows a client to spoof its IP address when the ProxyOn feature is enabled. The PROXY protocol, intended to pass the original client IP from a reverse proxy, can be invoked multiple times by the client. Each subsequent PROXY command overrides the previous one, enabling an attacker to inject arbitrary IP addresses. This can bypass IP-based access controls, logging, and rate limiting. The vulnerability is fixed in version 1.6.7.

Supply Chain & Package Security

This vulnerability affects the Go package github.com/go-guerrilla/guerrilla. Users of this package in Go projects should update to version 1.6.7 or later. The package is available via go get and is used in environments where SMTP services are deployed with proxy support.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

The low integrity impact reflects the ability to spoof IP addresses, which can affect logging and access controls but does not directly compromise data or system availability.

Deep Dive & Mechanics

The PROXY protocol (v1 or v2) is used by reverse proxies to inform the backend server of the original client's IP address. In Go-Guerrilla, when ProxyOn is enabled, the server expects a single PROXY header at the start of the connection. However, due to improper validation, the server accepts multiple PROXY commands. Each subsequent command overwrites the stored client IP.

An attacker can connect directly to the SMTP server (bypassing the proxy) and send a forged PROXY header, followed by another PROXY header with a spoofed IP. The server will use the last PROXY header for logging and access decisions. This allows the attacker to:

• Bypass IP whitelists/blacklists.
• Inject false IPs into logs.
• Evade rate limiting based on IP.

The fix in version 1.6.7 ensures that the PROXY command is only accepted once per connection, ignoring any subsequent PROXY headers.

Vulnerable vs. Patched Code

Vulnerable Code (prior to 1.6.7):

func (s *server) handleConnection(conn net.Conn) {
    if s.config.ProxyOn {
        header, err := readProxyHeader(conn)
        if err == nil {
            // No check if already set
            s.setRemoteIP(conn, header.SourceIP)
        }
    }
    // ... rest of handling
}

Patched Code (1.6.7):

func (s *server) handleConnection(conn net.Conn) {
    if s.config.ProxyOn {
        header, err := readProxyHeader(conn)
        if err == nil && !s.proxyHeaderReceived {
            s.setRemoteIP(conn, header.SourceIP)
            s.proxyHeaderReceived = true
        }
    }
    // ... rest of handling
}

The patched version introduces a flag proxyHeaderReceived to ensure the PROXY header is only processed once.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install Go-Guerrilla version 1.6.6 (vulnerable) on a test server.
2. Enable ProxyOn in the configuration.
3. Use a tool like netcat or a custom script to send multiple PROXY headers.

Exploitation Steps:

1. Connect to the SMTP server on port 25 (or configured port).
2. Send a valid PROXY header (e.g., PROXY TCP4 192.168.1.1 10.0.0.1 1234 25).
3. Send a second PROXY header with a spoofed IP (e.g., PROXY TCP4 10.0.0.2 10.0.0.1 5678 25).
4. The server will use the last IP (10.0.0.2) for logging and access control.

Example using netcat:

echo -e "PROXY TCP4 192.168.1.1 10.0.0.1 1234 25\r\nPROXY TCP4 10.0.0.2 10.0.0.1 5678 25\r\nEHLO attacker\r\n" | nc -w 3 target 25

Blue Team

Detection:

• Monitor for multiple PROXY headers in a single SMTP connection.
• Alert on connections where the PROXY header source IP differs from the actual connection IP.
• Use network monitoring to detect direct connections to the SMTP port that should only be accessed via a proxy.

Hunting:

• Search logs for multiple PROXY commands from the same connection.
• Correlate SMTP logs with proxy logs to identify mismatches.

Indicators of Compromise (IOCs)

• Network: Multiple PROXY headers in a single TCP connection to the SMTP server.
• Logs: SMTP logs showing IP addresses that do not match the proxy's IP.
• System: Unusual IP addresses in access logs that bypass proxy filtering.

Detection Engineering

YARA Rule

rule CVE_2025_31135_Go_Guerrilla_Proxy_Spoof {
    meta:
        description = "Detects multiple PROXY headers in SMTP connections to Go-Guerrilla"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-31135"
    strings:
        $proxy_header = "PROXY " nocase
        $smtp_greeting = "220 " nocase
    condition:
        #proxy_header > 1 and $smtp_greeting
}

Sigma Rule

title: Multiple PROXY Headers in SMTP Connection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects multiple PROXY protocol headers in a single SMTP connection, indicating possible IP spoofing (CVE-2025-31135)
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: smtp
detection:
    selection:
        event: PROXY
    condition: selection | count() > 1 by src_ip
falsepositives:
    - Legitimate proxy reconnections (rare)
level: high

Suricata Rule

alert tcp any any -> any 25 (msg:"CVE-2025-31135 - Multiple PROXY Headers in SMTP"; flow:to_server; content:"PROXY "; nocase; pcre:"/PROXY .*PROXY /smi"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Upgrade: Update Go-Guerrilla to version 1.6.7 or later.
2. Workaround: Disable ProxyOn if not required, or ensure the SMTP server is only accessible via a trusted proxy.
3. Network Segmentation: Restrict direct access to the SMTP server to only the reverse proxy IP.
4. Monitoring: Implement detection rules (as above) to alert on anomalous PROXY header usage.

Valters IT
Securing Digital Frontiers