Chi - Client IP spoofing in ClientIPFromXFF via X-Forwarded-For

T1Covered by 1 source · first reported by Tenable Research at 21 Oct, 13:43 UTC

Chi - Client IP spoofing in ClientIPFromXFF via X-Forwarded-For In Golang Chi web framework, the ClientIPFromXFF skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct TCP peer in http.Request.RemoteAddr belongs to that CIDR. A client that can reach the Go…

devsecurity

Sources

• T1Chi - Client IP spoofing in ClientIPFromXFF via X-Forwarded-ForTenable Research21 Oct, 13:43