CVE-2025-10929: Drupal Reverse Proxy Header allows Manipulating User-Controlled Variables

The vulnerability exists in the reverse_proxy_header Drupal module, which is designed to help Drupal identify the true client IP address when operating behind a reverse proxy. The core of the vulnerability lies in two functions: reverse_proxy_header_boot in reverse_proxy_header.module and onKernelRequest in src/EventSubscriber/ReverseProxyHeaderSubscriber.php. Both functions were responsible for reading an IP address from a configured HTTP header (e.g., X-Forwarded-For) and setting it as the client's remote address (REMOTE_ADDR).

The flaw was that this operation was performed without proper validation. Specifically, the code did not check if the request was coming from a trusted reverse proxy. As a result, an attacker could send a request directly to the web server (or through a trusted proxy that allows passing arbitrary headers) with a forged header, effectively spoofing their IP address. This could allow them to bypass IP-based restrictions, such as access control lists or rate limiting.

The patch addresses this by introducing a check using $request->isFromTrustedProxy(). With the fix, the module will only use the IP from the header if the request does not come from a trusted proxy, or if a new setting $settings['reverse_proxy_header_trusted_addresses_ignore'] is explicitly set to TRUE. This ensures that the IP address is only rewritten in environments where it is safe to do so, preventing the IP spoofing vulnerability.