CVE-2023-50463: Header spoofing in caddy-geo-ip

December 11, 2023

The caddy-geo-ip (aka GeoIP) middleware through 0.6.0 for Caddy 2, when trust_header X-Forwarded-For is used, allows attackers to spoof their source IP address via an X-Forwarded-For header, which may bypass a protection mechanism (trusted_proxy directive in reverse_proxy or IP address range restrictions).

References

caddyserver.com/v2
github.com/advisories/GHSA-rxg9-hgq7-8pwx
github.com/shift72/caddy-geo-ip/issues/4
github.com/shift72/caddy-geo-ip/tags
nvd.nist.gov/vuln/detail/CVE-2023-50463

Code Behaviors & Features

Detect and mitigate CVE-2023-50463 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →