CVE-2022-23556: CodeIgniter4 allows spoofing of IP address when using proxy
Summary
CVE-2022-23556: CodeIgniter4 allows spoofing of IP address when using proxy. Affects codeigniter4/framework versions < 4.2.11. Fixed in 4.2.11. How to fix ↓
Also tracked for
- codeigniter · Bitnami
The same CVE-2022-23556 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CodeIgniter4 is a popular PHP framework used for developing web applications. It provides a set of libraries and tools that simplify the development process. One of its features is the ability to handle HTTP requests and retrieve information such as the client's IP address. However, a vulnerability has been discovered in CodeIgniter4 that allows attackers to spoof their IP address when the server is behind a reverse proxy.
Vulnerability Detail
The vulnerability in CodeIgniter4 allows attackers to manipulate the IP address reported by the server when it is behind a reverse proxy. This can lead to IP address spoofing, where an attacker can pretend to be a different client by sending requests with a forged IP address. This can have various ramifications, such as bypassing IP-based access controls or hiding the true origin of an attack. The vulnerability is rated as HIGH severity with a CVSS score of 7.0.
How To Fix
Minimum fixed version
4.2.11
This is the first release that contains the fix.
composer require codeigniter4/framework:4.2.11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to avoid using the $request->getIPAddress() method in CodeIgniter4. Instead, alternative methods or custom logic can be implemented to retrieve the client's IP address.
Conclusion
The vulnerability in CodeIgniter4 allows attackers to spoof their IP address when the server is behind a reverse proxy. It is important to upgrade to the latest version of CodeIgniter4 and configure the Config\App::$proxyIPs setting to mitigate this vulnerability. If immediate upgrade is not possible, alternative methods should be used to retrieve the client's IP address. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for codeigniter4/framework →
FAQ
CodeIgniter4 is a PHP framework used for developing web applications. It provides a set of libraries and tools that simplify the development process.
IP address spoofing is a technique where an attacker manipulates the IP address reported by the server. This can be used to impersonate a different client or hide the true origin of an attack.
The possible ramifications of IP address spoofing in CodeIgniter4 include bypassing IP-based access controls and hiding the true origin of an attack.
This vulnerability is rated as HIGH severity with a CVSS score of 7.0.
To fix this vulnerability, it is recommended to upgrade to version 4.2.11 or later of CodeIgniter4 and configure Config\App::$proxyIPs properly. Alternatively, avoid using the $request->getIPAddress() method.
References
Related vulnerabilities
Recent vulnerabilities recorded for codeigniter4/framework.
