PT-2023-31567 · Caddy · Caddy-Geo-Ip

Adryd325 · Published 2023-12-10 · Updated 2024-01-02 · CVE-2023-50463

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions caddy-geo-ip versions 0.6.0 and earlier for Caddy 2

Description The issue allows attackers to spoof their source IP address via an X-Forwarded-For header, which may bypass a protection mechanism, such as the trusted proxy directive in reverse proxy or IP address range restrictions, when trust header X-Forwarded-For is used.

Recommendations For caddy-geo-ip versions 0.6.0 and earlier, consider disabling the trust header X-Forwarded-For until a patch is available to prevent attackers from spoofing their source IP address. Restrict access to the reverse proxy directive to minimize the risk of exploitation. Avoid using the X-Forwarded-For header in the affected middleware until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2023-50463

GHSA-RXG9-HGQ7-8PWX

GO-2023-2394

Affected Products

Caddy-Geo-Ip

References · 11

• https://osv.dev/vulnerability/CVE-2023-50463 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-50463 · Security Note
• https://osv.dev/vulnerability/GHSA-rxg9-hgq7-8pwx · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-2394 · Vendor Advisory
• https://github.com/shift72/caddy-geo-ip/issues/4 · Note
• https://github.com/shift72/caddy-geo-ip/tags · Note
• https://caddyserver.com/v2 · Note
• https://twitter.com/CVEnew/status/1733979852116779171 · Twitter Post
• https://t.me/cvenotify/63548 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1734026334089756959 · Twitter Post
• https://t.me/cvenotify/63126 · Telegram Post