Security readout for executives and security teams
Plain-English summary
A remote, unauthenticated attacker may impersonate a trusted client IP by supplying matching forwarding headers. Applications relying on http-protection for IP-based access controls could consequently expose protected functions or data. The supplied assessment rates this critical, but actual business risk depends on whether the affected package protects reachable routes.
Executive priority
Treat confirmed internet-facing use as an immediate remediation priority because bypass could undermine the control guarding sensitive routes. Prioritize asset discovery first; if the package is absent or does not make authorization decisions, document that evidence and reassess urgency.
Technical view
Crystal Shard http-protection versions through 0.2.0 trust attacker-controlled X-Forwarded-For, X-Client-IP, and X-Real-IP values, enabling an IP-authentication bypass classified as CWE-290. The supplied CVSS 3.1 score is 9.8: network-accessible, low complexity, no privileges or interaction required, with potentially high confidentiality, integrity, and availability impact.
Likely exposure
Exposure is most likely where internet-reachable applications use http-protection 0.2.0 or earlier for IP-based authorization and accept forwarding headers from untrusted clients. The source bundle provides no deployment prevalence, package inventory, or confirmed affected organizations.
Exploitation context
ExploitDB publishes an exploit-tagged reference, indicating public exploitation information exists. However, the source bundle marks this CVE absent from KEV and provides no evidence of active exploitation, observed attacks, or exploitation at scale.
Researcher notes
The record identifies versions through 0.2.0, CWE-290, and header-based IP spoofing. No corrected release, vendor mitigation, affected configuration detail, or active-exploitation evidence is supplied. The CVE identifier is from 2020, while the provided publication date is 2026-01-30; analysts should preserve that distinction in reporting.
Mitigation direction
- Identify and prioritize internet-facing applications using http-protection 0.2.0 or earlier.
- Check the repository and vendor guidance for a supported corrected version or replacement.
- Restrict protected routes through independently enforced authentication and network controls.
- Configure trusted proxies to remove client-supplied forwarding headers before adding authoritative values.
- Avoid treating forwarding headers alone as proof of client identity.
Validation and detection
- Inventory application manifests and lockfiles for http-protection versions through 0.2.0.
- Confirm whether affected middleware controls authentication, authorization, or access to sensitive routes.
- Review proxy boundaries and determine whether clients can directly supply trusted forwarding headers.
- Test compensating controls in an authorized non-production environment without accessing protected data.
- Review request logs for suspiciously coordinated forwarding-header values, recognizing legitimate proxies may produce similar patterns.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-290: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2020-37056 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9VulnCheckCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
6.9MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-48533CVE reference, VulnCheck · exploit
- HTTP Protection Crystal Shard RepositoryCVE reference, VulnCheck · product
- VulnCheck Advisory: Crystal Shard http-protection 0.2.0 - IP Spoofing BypassCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Authentication Bypass by Spoofing
Authentication Bypass by Spoofing represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.