{"id":"GHSA-rjr7-jggh-pgcp","title":"chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header","summary":"chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header","severity":"high","cwe":["CWE-290","CWE-348"],"vendor":"go-chi","product":"github.com/go-chi/chi/middleware","ecosystem":"go","affected":["github.com/go-chi/chi/middleware <= 1.5.5","github.com/go-chi/chi/v2/middleware <= 2.1.1","github.com/go-chi/chi/v3/middleware <= 3.3.5","github.com/go-chi/chi/v4/middleware <= 4.1.3","github.com/go-chi/chi/v5/middleware < 5.3.0"],"patched":["github.com/go-chi/chi/v5/middleware 5.3.0"],"published":"2026-06-25","updated":"2026-06-25","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-rjr7-jggh-pgcp","references":[{"url":"https://github.com/go-chi/chi/security/advisories/GHSA-rjr7-jggh-pgcp"},{"url":"https://github.com/go-chi/chi/releases/tag/v5.3.0"},{"url":"https://github.com/advisories/GHSA-rjr7-jggh-pgcp"}],"tags":["ghsa","go"],"ingestedAt":"2026-06-26T16:43:14.240Z","slug":"GHSA-rjr7-jggh-pgcp","body":"## Overview\n\n### Summary\nrealip middleware in go-chi/chi trusts headers like x-forwarded-for without checking them, so attackers can fake their ip and bypass rate limits or access controls\n\n### Details\n\nthe vuln is in middleware/realip.go , the realIP() function pulls IPs straight from client headers and replaces r.RemoteAddr without checking if the request came from a trusted proxy\n\n```go\nfunc realIP(r *http.Request) string {\n    var ip string\n    if tcip := r.Header.Get(trueClientIP); tcip != \"\" {\n        ip = tcip  // controlled by attacker\n    } else if xrip := r.Header.Get(xRealIP); xrip != \"\" {\n        ip = xrip  // controlled by attacker\n    } else if xff := r.Header.Get(xForwardedFor); xff != \"\" {\n        ip, _, _ = strings.Cut(xff, \",\")  // controlled by attacker\n    }\n    // ...\n    return ip\n}\n```\n\nno trusted proxy cidr check in place, any client can send these headers\n\n### PoC\n\ncreate a server with chi and use realip middleware\n\n```go\npackage main\n\nimport (\n    \"fmt\"\n    \"net/http\"\n    \"github.com/go-chi/chi/v5\"\n    \"github.com/go-chi/chi/v5/middleware\"\n)\n\nfunc main() {\n    r := chi.NewRouter()\n    r.Use(middleware.RealIP)\n\n    r.Get(\"/admin\", func(w http.ResponseWriter, r *http.Request) {\n        // ip-based access control got bypassed\n        if r.RemoteAddr == \"127.0.0.1\" {\n            w.Write([]byte(\"SECRET ADMIN DATA\"))\n            return\n        }\n        http.Error(w, \"Forbidden\", 403)\n    })\n\n    http.ListenAndServe(\":8080\", r)\n}\n```\n\nspoofed the ip to bypass access control\n\n```bash\ncurl -H \"X-Forwarded-For: 127.0.0.1\" http://localhost:8080/admin\n```\n\n\n### Impact\n\n- ip-based access control bypass lets attackers reach restricted endpoints\n- rate limiting bypass lets attackers avoid limits by rotating spoofed ips\n- audit logs show fake ips picked by attacker instead of real ones\n- attackers can get around geo ip restrictions\n\n## Remediation Recommendation\n\nvalidate proxy cidr first before trusting forwarded ip headers\n\n```go\n// add your reverse proxy ip addresses here\nvar trustedProxies = []net.IPNet{\n       {IP: net.ParseIP(\"10.0.0.0\"), Mask: net.CIDRMask(8, 32)},\n    {IP: net.ParseIP(\"172.16.0.0\"), Mask: net.CIDRMask(12, 32)},\n    {IP: net.ParseIP(\"192.168.0.0\"), Mask: net.CIDRMask(16, 32)},\n}\n\nfunc isTrustedProxy(ip net.IP) bool {\n    for _, cidr := range trustedProxies {\n        if cidr.Contains(ip) {\n            return true\n        }\n    }\n    return false\n}\n```\n\n## Affected packages\n\n- `github.com/go-chi/chi/middleware <= 1.5.5`\n- `github.com/go-chi/chi/v2/middleware <= 2.1.1`\n- `github.com/go-chi/chi/v3/middleware <= 3.3.5`\n- `github.com/go-chi/chi/v4/middleware <= 4.1.3`\n- `github.com/go-chi/chi/v5/middleware < 5.3.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/go-chi/chi/v5/middleware 5.3.0`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}