CVE-2022-2255: mod_wsgi X-Client-IP Header Removal Vulnerability
Summary
CVE-2022-2255: A vulnerability was found in mod_wsgi. Affects mod_wsgi versions < 4.9.3. Fixed in 4.9.3. How to fix ↓
Also tracked for
The same CVE-2022-2255 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mod_wsgi is an Apache HTTP Server module that enables hosting of Python web applications. It provides a bridge between the Apache server and the Python web application, allowing seamless integration and efficient handling of requests. This vulnerability affects mod_wsgi versions prior to 4.9.3.
Vulnerability Detail
The vulnerability in mod_wsgi arises from the failure to remove the X-Client-IP header from requests originating from untrusted proxies. This oversight enables an attacker to pass the X-Client-IP header to the target WSGI application. The absence of the condition to remove this header allows the attacker to potentially manipulate or spoof the client IP address, leading to various security implications such as IP-based access control bypass or IP-based authentication bypass.
How To Fix
Minimum fixed version
4.9.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is possible to manually remove the X-Client-IP header from incoming requests before they reach the mod_wsgi module. This can be achieved by configuring the web server or any other proxy server in front of mod_wsgi to strip the X-Client-IP header. The specific steps to implement this workaround may vary depending on the server software being used.
Conclusion
The mod_wsgi X-Client-IP Header Removal Vulnerability allows an attacker to manipulate or spoof the client IP address, potentially bypassing IP-based access control or authentication mechanisms. It is crucial to upgrade to mod_wsgi version 4.9.3 or later to mitigate this vulnerability. In the meantime, a temporary workaround can be implemented by removing the X-Client-IP header from incoming requests. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mod_wsgi →
FAQ
mod_wsgi is an Apache HTTP Server module that allows hosting of Python web applications.
This vulnerability allows an attacker to manipulate or spoof the client IP address, potentially bypassing IP-based access control or authentication mechanisms.
Versions of mod_wsgi prior to 4.9.3 are affected by this vulnerability.
To fix this vulnerability, upgrade to mod_wsgi version 4.9.3 or later.
Yes, a temporary workaround is to remove the X-Client-IP header from incoming requests before they reach mod_wsgi.
Related vulnerabilities
Recent vulnerabilities recorded for mod_wsgi.
