Google Go up to 1.17.11/1.18.3 net-http httputil.ReverseProxy.ServeHTTP X-Forwarded-For information disclosure

Summaryinfo

A vulnerability, which was classified as problematic, was found in Google Go up to 1.17.11/1.18.3. This impacts the function httputil.ReverseProxy.ServeHTTP of the component net-http. Such manipulation of the argument X-Forwarded-For leads to information disclosure. This vulnerability is listed as CVE-2022-32148. The attack may be performed from remote. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Google Go up to 1.17.11/1.18.3 (Programming Language Software). Affected by this issue is the function httputil.ReverseProxy.ServeHTTP of the component net-http. The manipulation of the argument X-Forwarded-For with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. CVE summarizes:

Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For header.

The weakness was presented 08/11/2022. The advisory is available at go.dev. This vulnerability is handled as CVE-2022-32148 since 05/31/2022. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1592 by the MITRE ATT&CK project.

The vulnerability scanner Nessus provides a plugin with the ID 211529 (Oracle Linux 9 : grafana (ELSA-2024-9115)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.17.12 or 1.18.4 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (211529) and CERT Bund (WID-SEC-2022-0879). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Affected

• Amazon Linux 2
• Red Hat Enterprise Linux
• SUSE Linux
• Oracle Linux
• Red Hat OpenShift
• Gentoo Linux
• RESF Rocky Linux

Productinfo

Type

• Programming Language Software

Vendor

• Google

Name

• Go

Version

• 1.17.0
• 1.17.1
• 1.17.2
• 1.17.3
• 1.17.4
• 1.17.5
• 1.17.6
• 1.17.7
• 1.17.8
• 1.17.9
• 1.17.10
• 1.17.11
• 1.18.0
• 1.18.1
• 1.18.2
• 1.18.3

License

• open-source

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion