CVE-2022-32148: Improper exposure of client IP addresses in golang
Summary
CVE-2022-32148: Exposure of client IP addresses in net/http. Affects golang across 2 version ranges.
< 1.17.12
>= 1.18.0, < 1.18.4
Fixed in 1.17.12 or 1.18.4, depending on the release line you run. How to fix ↓
Also tracked for
- golang-1.15 · Debian:11
- stdlib · Go
The same CVE-2022-32148 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Golang is an open-source programming language that is designed to be efficient, secure, and easy to use. It is widely used for developing various types of applications, including web servers. The vulnerability in golang allows for the improper exposure of client IP addresses when using the net/http package. This can be exploited by passing a nil value for the X-Forwarded-For header, which causes the ReverseProxy to set the client IP as the value of the X-Forwarded-For header.
Vulnerability Detail
The vulnerability arises from a flaw in the net/http package of golang. By manipulating the Request.Header map and setting a nil value for the X-Forwarded-For header, an attacker can trick the ReverseProxy into exposing the client's IP address. This can lead to potential privacy concerns and enable attackers to gather sensitive information about clients. The vulnerability has a medium severity rating and can be exploited by an attacker with network access to the affected server.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.17.121.17.12 -
>= 1.18.0, < 1.18.41.18.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating golang is not immediately feasible, a temporary workaround can be implemented by manually checking the X-Forwarded-For header in the ServeHTTP function of the ReverseProxy. By validating the value of the X-Forwarded-For header and ensuring it is not nil, the exposure of client IP addresses can be mitigated. Here is an example of how this can be done in Go:
func (rp *ReverseProxy) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
if req.Header.Get("X-Forwarded-For") != "" {
// Process the request
}
}
Conclusion
The vulnerability in golang's net/http package allows for the improper exposure of client IP addresses. This can have privacy implications and enable attackers to gather sensitive information. It is recommended to update golang to the latest version to mitigate this vulnerability. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for golang →
FAQ
The vulnerability allows for the exposure of client IP addresses, which can lead to potential privacy concerns and enable attackers to gather sensitive information about clients.
Any application or server that uses the golang net/http package and processes client requests can be affected by this vulnerability.
Yes, this vulnerability can be exploited remotely by an attacker with network access to the affected server.
There are no known instances of this vulnerability being actively exploited at the moment.
Yes, updating golang to version 1.17.12 or 1.18.4 will fix this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
