Duplicate Advisory: chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For
GHSA-7cgw-qmxx-7fc2
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-j6qf-3m9c-vwj3. This link is maintained to preserve external references.
Original Description
In the Golang Chi web framework, the ClientIPFromXFF middleware skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct TCP peer in http.Request.RemoteAddr belongs to that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking proxy address and choose the client IP returned by middleware.GetClientIP.
This issue affects chi before 5.4.0.
Ready to move
Start Securing
Free, no credit card | First findings in minutes