CVE-2023-50463: Header spoofing in caddy-geo-ip

December 11, 2023

The caddy-geo-ip (aka GeoIP) middleware through 0.6.0 for Caddy 2, when trust_header X-Forwarded-For is used, allows attackers to spoof their source IP address via an X-Forwarded-For header, which may bypass a protection mechanism (trusted_proxy directive in reverse_proxy or IP address range restrictions).

References

caddyserver.com/v2
github.com/advisories/GHSA-rxg9-hgq7-8pwx
github.com/shift72/caddy-geo-ip/issues/4
github.com/shift72/caddy-geo-ip/tags
nvd.nist.gov/vuln/detail/CVE-2023-50463

Code Behaviors & Features

Detect and mitigate CVE-2023-50463 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →