Описание
go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP (Request.RemoteAddr) using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the first value of the X-Forwarded-For header to spoof the request source IP, potentially bypassing access controls or falsifying request logs.
A flaw was found in the go-chi/chi component. The RealIP middleware, responsible for resolving the request source IP, does not properly validate trusted proxies when processing the X-Forwarded-For header. A remote attacker can exploit this by prepending a forged IP address to the X-Forwarded-For header, leading to IP spoofing. This could allow the attacker to bypass access controls or falsify request logs.
Отчет
A flaw in the go-chi/chi RealIP middleware allows remote attackers to spoof source IP addresses (Request.RemoteAddr). The middleware parses the first IP address in the X-Forwarded-For header without verifying if the immediate HTTP proxy peer is trusted. An unauthenticated attacker can prepend an arbitrary IP address to the X-Forwarded-For header, causing applications relying on RealIP for request context to misidentify the client source. This enables bypassing application-level IP-based access control lists (ACLs) or spoofing identity in audit logs.
Меры по смягчению последствий
Disable the default RealIP middleware and replace it with a proxy-aware middleware (such as httputil.ReverseProxy or custom header parsing) that strictly validates upstream reverse proxies against an explicit list of trusted CIDR ranges before accepting X-Forwarded-For headers.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Cryostat 4 | cryostat/cryostat-storage-rhel9 | Fix deferred | ||
| External Secrets Operator for Red Hat OpenShift | external-secrets-operator/bitwarden-sdk-server-rhel9 | Fix deferred | ||
| Gatekeeper 3 | gatekeeper/gatekeeper-rhel9 | Fix deferred | ||
| Logging Subsystem for Red Hat OpenShift | openshift-logging/opa-openshift-rhel9 | Fix deferred | ||
| Migration Toolkit for Applications 8 | mta/mta-hub-rhel9 | Fix deferred | ||
| Multicluster Engine for Kubernetes | multicluster-engine/assisted-image-service-rhel8 | Fix deferred | ||
| Multicluster Engine for Kubernetes | multicluster-engine/assisted-image-service-rhel9 | Fix deferred | ||
| OpenShift Pipelines | openshift-pipelines-client | Fix deferred | ||
| OpenShift Pipelines | openshift-pipelines/pipelines-opc-rhel9 | Fix deferred | ||
| OpenShift Serverless | openshift-serverless-1/kn-plugin-event-sender-rhel9 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
6.5 Medium
CVSS3
Связанные уязвимости
go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP (Request.RemoteAddr) using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the first value of the X-Forwarded-For header to spoof the request source IP, potentially bypassing access controls or falsifying request logs.
go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP (Request.RemoteAddr) using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the first value of the X-Forwarded-For header to spoof the request source IP, potentially bypassing access controls or falsifying request logs.
go-chi chi 0.9.0 before 5.3.0 IP Spoofing via X-Forwarded-For
go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnera ...
go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP (Request.RemoteAddr) using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the first value of the X-Forwarded-For header to spoof the request source IP, potentially bypassing access controls or falsifying request logs.
EPSS
6.5 Medium
CVSS3