—

GO-2023-2052

IsFromLocal local address check can be circumvented in github.com/gofiber/fiber/v2

Quick fix

GO-2023-2052 — github.com/gofiber/fiber/v2: upgrade to the fixed version with the command below.

go get github.com/gofiber/fiber/v2@v2.49.2-0.20230906112033-b8c9ede6efa2

Details

The Ctx.IsFromLocal function can incorrectly report a request as being sent from localhost when the request contains an X-Forwarded-For header containing a localhost IP address.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/gofiber/fiber/v2

Introduced in: 0Fixed in: 2.49.2-0.20230906112033-b8c9ede6efa2

Fixgo get github.com/gofiber/fiber/v2@v2.49.2-0.20230906112033-b8c9ede6efa2

References

https://github.com/gofiber/fiber/security/advisories/GHSA-3q5p-3558-364f[ADVISORY]
https://github.com/gofiber/fiber/commit/b8c9ede6efa231116c4bd8bb9d5e03eac1cb76dc[FIX]