IP Spoofing in Go-Chi Chi Router

Executive Summary

This vulnerability is an IP spoofing issue in the go-chi/chi library's RealIP middleware. The middleware reads client-controlled headers like True-Client-IP, X-Real-IP, and X-Forwarded-For to overwrite the remote address without verifying the request came from a trusted proxy. Attackers can manipulate these headers to falsify their IP address.

Useful 0 Not Useful 0

Detection Guidance

Check if your go-chi/chi version is below 5.3.0 by running: go list -m github.com/go-chi/chi. Inspect HTTP headers like X-Forwarded-For, X-Real-IP, and True-Client-IP in requests to see if they contain arbitrary IP addresses not matching the actual client IP.

Useful 0 Not Useful 0

Impact Analysis

• Bypass IP-based access controls by spoofing allowed IP addresses.
• Evade rate limiting systems that restrict requests based on IP.
• Circumvent geo-IP restrictions to access region-locked content.
• Pollute audit logs with fake IP addresses, obscuring real activity.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could undermine compliance by allowing unauthorized access to sensitive data, making it difficult to accurately track user activity in audit logs. This may violate requirements for data access logging and user accountability in standards like GDPR and HIPAA.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade go-chi/chi to version 5.3.0 or later. If upgrading is not possible, validate proxy CIDR ranges before trusting forwarded IP headers. Ensure middleware only processes headers from trusted proxies.

Useful 0 Not Useful 0