Caddy GeoIP Middleware Spoofing Vulnerability in X-Forwarded-For Header

A vulnerability exists in the Caddy GeoIP middleware, specifically in versions through 0.6.0, when the X-Forwarded-For header is trusted. This configuration allows attackers to spoof their source IP address, potentially bypassing protections like the trusted_proxy directive in reverse_proxy and IP address range restrictions. The issue arises because the trust_header option overwrites the req.RemoteAddr variable, which can be exploited to manipulate the remote address in subsequent request checks.

Impact

Exploitation of this vulnerability can lead to unauthorized bypassing of IP address restrictions and other checks that rely on the req.RemoteAddr variable, allowing for potential misuse of the application or service.

Reproduction

To reproduce this vulnerability, configure the Caddy GeoIP middleware to trust the X-Forwarded-For header. Then, send a request with a spoofed X-Forwarded-For header to manipulate the remote address. This can be verified by accessing a route that responds with the remote host information, which will reflect the spoofed IP address.