ip blacklist bypass vulnerability

[Shydlock]

ip blacklist bypass vulnerability

Process

1. Set up ip blacklist for 127.0.0.1（Due to the existence of a system bug, only 27.0.0.1 can be set here, but it is limited to 127.0.0.1）

   

2. Re-visit the page and find that it has been restricted by the ip blacklist

   

   

3. But here you can bypass the blacklist restriction by setting the X-Real-IP request header

   

Key issues in the code

1. ipAddress() in com.blade.kit.WebKit