CVE-2022-32148
Exposure of client IP addresses in net/http
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For header.
Una exposición inapropiada de las direcciones IP de los clientes en net/http versiones anteriores a Go 1.17.12 y Go 1.18.4, puede desencadenarse llamando a httputil.ReverseProxy.ServeHTTP con un mapa Request.Header que contenga un valor nulo para el encabezado X-Forwarded-For, lo que causa que ReverseProxy establezca la IP del cliente como valor de el encabezado X-Forwarded-For
A flaw was found in net/http/httputil golang package. When httputil.ReverseProxy.ServeHTTP is called with a Request.Header map containing a nil value for the X-Forwarded-For header, ReverseProxy could set the client IP incorrectly. This issue may affect confidentiality.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-05-31 CVE Reserved
- 2022-08-04 CVE Published
- 2024-03-01 EPSS Updated
- 2024-08-03 CVE Updated
- 2024-08-03 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CAPEC
References (7)
| URL | Tag | Source |
|---|---|---|
| https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE | Mailing List |
| URL | Date | SRC |
|---|---|---|
| https://go.dev/issue/53423 | 2024-08-03 |
| URL | Date | SRC |
|---|---|---|
| https://go.dev/cl/412857 | 2023-11-07 | |
| https://go.googlesource.com/go/+/b2cc0fecc2ccd80e6d5d16542cc684f97b3a9c8a | 2023-11-07 |
| URL | Date | SRC |
|---|---|---|
| https://pkg.go.dev/vuln/GO-2022-0520 | 2023-11-07 | |
| https://access.redhat.com/security/cve/CVE-2022-32148 | 2023-06-19 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2107383 | 2023-06-19 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Golang Search vendor "Golang" | Go Search vendor "Golang" for product "Go" | < 1.17.12 Search vendor "Golang" for product "Go" and version " < 1.17.12" | - |
Affected
| ||||||
| Golang Search vendor "Golang" | Go Search vendor "Golang" for product "Go" | >= 1.18.0 < 1.18.4 Search vendor "Golang" for product "Go" and version " >= 1.18.0 < 1.18.4" | - |
Affected
| ||||||