## Summary The `BalancerForward` proxy helper in GoFiber uses `Header.Add()` instead of `Header.Set()` when injecting the `X-Real-IP` header. This appends the real client IP as a second header value rather than replacing any attacker-supplied value. Upstream servers that read the first `X-Real-IP` header (nginx, Express, most HTTP servers) use the attacker's spoofed IP for logging, rate limiting, and access control. ## Vulnerable Code **File:** `middleware/proxy/proxy.go`, lines 270-285 ```go func BalancerForward(servers []string, clients ...*fasthttp.Client) fiber.Handler { r := &roundrobin{ current: 0, pool: servers, } return func(c fiber.Ctx) error { server := r.get() if !strings.HasPrefix(server, "http") { server = "http://" + server } c.Request().Header.Add("X-Real-IP", c.IP()) // line 282: Add, not Set return Do(c, server+c.OriginalURL(), clients...) } } ``` ## Data Flow 1. Attacker sends request with `X-Real-IP: 10.0.0.1` (spoofed internal IP) 2. `BalancerForward` handler executes at line 282 3. `c.Request().Header.Add("X-Real-IP", c.IP())` APPENDS the real IP as a second header 4. Upstream server receives: `X-Real-IP: 10.0.0.1` AND `X-Real-IP: <real-attacker-ip>` 5. Most HTTP servers (nginx, Node.js, Apache) read the FIRST value 6. Upstream uses `10.0.0.1` for all IP-dependent logic ## Impact - **Rate limit bypass:** IP-based rate limiting at the upstream uses the spoofed IP, allowing unlimited requests - **IP ACL bypass:** Internal IP allowlists (e.g., admin panels restricted to `10.0.0.0/8`) can be bypassed - **Audit log poisoning:** Security logs record the spoofed IP, making incident investigation unreliable - **Geolocation bypass:** IP-based geofencing or region restrictions are circumvented ## Fix Replace `Header.Add()` with `Header.Set()` at line 282: ```go c.Request().Header.Set("X-Real-IP", c.IP()) ``` `Header.Set()` replaces any existing header value, ensuring only the real client IP is forwarded.
## Summary The `BalancerForward` proxy helper in GoFiber uses `Header.Add()` instead of `Header.Set()` when injecting the `X-Real-IP` header. This appends the real client IP as a second header value rather than replacing any attacker-supplied value. Upstream servers that read the first `X-Real-IP` header (nginx, Express, most HTTP servers) use the attacker's spoofed IP for logging, rate limiting, and access control. ## Vulnerable Code **File:** `middleware/proxy/proxy.go`, lines 270-285 ```go func BalancerForward(servers []string, clients ...*fasthttp.Client) fiber.Handler { r := &roundrobin{ current: 0, pool: servers, } return func(c fiber.Ctx) error { server := r.get() if !strings.HasPrefix(server, "http") { server = "http://" + server } c.Request().Header.Add("X-Real-IP", c.IP()) // line 282: Add, not Set return Do(c, server+c.OriginalURL(), clients...) } } ``` ## Data Flow 1. Attacker sends request with `X-Real-IP: 10.0.0.1` (spoofed internal IP) 2. `BalancerForward` handler executes at line 282 3. `c.Request().Header.Add("X-Real-IP", c.IP())` APPENDS the real IP as a second header 4. Upstream server receives: `X-Real-IP: 10.0.0.1` AND `X-Real-IP: <real-attacker-ip>` 5. Most HTTP servers (nginx, Node.js, Apache) read the FIRST value 6. Upstream uses `10.0.0.1` for all IP-dependent logic ## Impact - **Rate limit bypass:** IP-based rate limiting at the upstream uses the spoofed IP, allowing unlimited requests - **IP ACL bypass:** Internal IP allowlists (e.g., admin panels restricted to `10.0.0.0/8`) can be bypassed - **Audit log poisoning:** Security logs record the spoofed IP, making incident investigation unreliable - **Geolocation bypass:** IP-based geofencing or region restrictions are circumvented ## Fix Replace `Header.Add()` with `Header.Set()` at line 282: ```go c.Request().Header.Set("X-Real-IP", c.IP()) ``` `Header.Set()` replaces any existing header value, ensuring only the real client IP is forwarded.
Update github.com/gofiber/fiber/v3 to 3.3.0 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanGoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForward affects github.com/gofiber/fiber/v2 (go), github.com/gofiber/fiber/v3 (go). Severity is medium. ## Summary The `BalancerForward` proxy helper in GoFiber uses `Header.Add()` instead of `Header.Set()` when injecting the `X-Real-IP` header. This appends the real client IP as a second header value rather than replacing any attacker-supplied value. Upstream servers that read the first `X-Real-IP` header (nginx, Express, most HTTP servers) use the attacker's spoofed IP for logging, rate limiting, and access control. ## Vulnerable Code **File:** `middleware/proxy/proxy.go`, lines 270-285 ```go func BalancerForward(servers []string, clients ...*fasthttp.Client) fiber.Handler { r := &roundrobin{ current: 0, pool: servers, } return func(c fiber.Ctx) error { server := r.get() if !strings.HasPrefix(server, "http") { server = "http://" + server } c.Request().Header.Add("X-Real-IP", c.IP()) // line 282: Add, not Set return Do(c, server+c.OriginalURL(), clients...) } } ``` ## Data Flow 1. Attacker sends request with `X-Real-IP: 10.0.0.1` (spoofed internal IP) 2. `BalancerForward` handler executes at line 282 3. `c.Request().Header.Add("X-Real-IP", c.IP())` APPENDS the real IP as a second header 4. Upstream server receives: `X-Real-IP: 10.0.0.1` AND `X-Real-IP: <real-attacker-ip>` 5. Most HTTP servers (nginx, Node.js, Apache) read the FIRST value 6. Upstream uses `10.0.0.1` for all IP-dependent logic ## Impact - **Rate limit bypass:** IP-based rate limiting at the upstream uses the spoofed IP, allowing unlimited requests - **IP ACL bypass:** Internal IP allowlists (e.g., admin panels restricted to `10.0.0.0/8`) can be bypassed - **Audit log poisoning:** Security logs record the spoofed IP, making incident investigation unreliable - **Geolocation bypass:** IP-based geofencing or region restrictions are circumvented ## Fix Replace `Header.Add()` with `Header.Set()` at line 282: ```go c.Request().Header.Set("X-Real-IP", c.IP()) ``` `Header.Set()` replaces any existing header value, ensuring only the real client IP is forwarded.
AI coding agents often install or upgrade packages automatically in go. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| github.com/gofiber/fiber/v2go | <=2.52.13 | Not reported |
| github.com/gofiber/fiber/v3go | <=3.2.0 | 3.3.0 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate github.com/gofiber/fiber/v3 to 3.3.0 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanGoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForward affects github.com/gofiber/fiber/v2 (go), github.com/gofiber/fiber/v3 (go). Severity is medium. ## Summary The `BalancerForward` proxy helper in GoFiber uses `Header.Add()` instead of `Header.Set()` when injecting the `X-Real-IP` header. This appends the real client IP as a second header value rather than replacing any attacker-supplied value. Upstream servers that read the first `X-Real-IP` header (nginx, Express, most HTTP servers) use the attacker's spoofed IP for logging, rate limiting, and access control. ## Vulnerable Code **File:** `middleware/proxy/proxy.go`, lines 270-285 ```go func BalancerForward(servers []string, clients ...*fasthttp.Client) fiber.Handler { r := &roundrobin{ current: 0, pool: servers, } return func(c fiber.Ctx) error { server := r.get() if !strings.HasPrefix(server, "http") { server = "http://" + server } c.Request().Header.Add("X-Real-IP", c.IP()) // line 282: Add, not Set return Do(c, server+c.OriginalURL(), clients...) } } ``` ## Data Flow 1. Attacker sends request with `X-Real-IP: 10.0.0.1` (spoofed internal IP) 2. `BalancerForward` handler executes at line 282 3. `c.Request().Header.Add("X-Real-IP", c.IP())` APPENDS the real IP as a second header 4. Upstream server receives: `X-Real-IP: 10.0.0.1` AND `X-Real-IP: <real-attacker-ip>` 5. Most HTTP servers (nginx, Node.js, Apache) read the FIRST value 6. Upstream uses `10.0.0.1` for all IP-dependent logic ## Impact - **Rate limit bypass:** IP-based rate limiting at the upstream uses the spoofed IP, allowing unlimited requests - **IP ACL bypass:** Internal IP allowlists (e.g., admin panels restricted to `10.0.0.0/8`) can be bypassed - **Audit log poisoning:** Security logs record the spoofed IP, making incident investigation unreliable - **Geolocation bypass:** IP-based geofencing or region restrictions are circumvented ## Fix Replace `Header.Add()` with `Header.Set()` at line 282: ```go c.Request().Header.Set("X-Real-IP", c.IP()) ``` `Header.Set()` replaces any existing header value, ensuring only the real client IP is forwarded.
AI coding agents often install or upgrade packages automatically in go. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| github.com/gofiber/fiber/v2go | <=2.52.13 | Not reported |
| github.com/gofiber/fiber/v3go | <=3.2.0 | 3.3.0 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard