PT-2023-31567 · Caddy · Caddy-Geo-Ip

Adryd325 · Publicado 2023-12-10 · Atualizado 2024-01-02 · CVE-2023-50463

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions caddy-geo-ip versions 0.6.0 and earlier for Caddy 2

Description The issue allows attackers to spoof their source IP address via an X-Forwarded-For header, which may bypass a protection mechanism, such as the trusted proxy directive in reverse proxy or IP address range restrictions, when trust header X-Forwarded-For is used.

Recommendations For caddy-geo-ip versions 0.6.0 and earlier, consider disabling the trust header X-Forwarded-For until a patch is available to prevent attackers from spoofing their source IP address. Restrict access to the reverse proxy directive to minimize the risk of exploitation. Avoid using the X-Forwarded-For header in the affected middleware until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Authentication Bypass by Spoofing

Enumeração de Fraquezas

CWE-290

Identificadores relacionados

CVE-2023-50463

GHSA-RXG9-HGQ7-8PWX

GO-2023-2394

Produtos afetados

Caddy-Geo-Ip

Referências · 11

• https://github.com/shift72/caddy-geo-ip/issues/4 · Nota
• https://github.com/shift72/caddy-geo-ip/tags · Nota
• https://caddyserver.com/v2 · Nota
• https://osv.dev/vulnerability/CVE-2023-50463 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-50463 · Nota de Segurança
• https://twitter.com/CVEnew/status/1733979852116779171 · Publicação no Twitter
• https://t.me/cvenotify/63548 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1734026334089756959 · Publicação no Twitter
• https://t.me/cvenotify/63126 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-rxg9-hgq7-8pwx · Aviso do Fabricante
• https://osv.dev/vulnerability/GO-2023-2394 · Aviso do Fabricante