Listen to this Post
The BalancerForward proxy helper in the GoFiber framework contains a critical security misconfiguration that allows attackers to spoof their IP address when requests are proxied to upstream servers. The vulnerability exists in the `middleware/proxy/proxy.go` file, specifically at lines 270-285, where the `BalancerForward` function handles the injection of the `X-Real-IP` header.
The core issue lies in the use of the `Header.Add()` method instead of `Header.Set()` when adding the real client IP to outgoing proxy requests. HTTP headers in Go are represented as map
[]string</code>, meaning multiple values can exist for the same header key. The `Header.Add()` method appends a new value to the existing header, while `Header.Set()` replaces all existing values with the new one.
When an attacker sends a request with a pre-existing `X-Real-IP` header (e.g., <code>X-Real-IP: 10.0.0.1</code>), the `BalancerForward` handler executes `c.Request().Header.Add("X-Real-IP", c.IP())` at line 282. This appends the real client IP as a second value rather than replacing the attacker-supplied value. The upstream server receives both headers: the attacker's spoofed IP first, followed by the real IP.
Most HTTP servers and frameworks—including nginx, Express.js, Node.js, and Apache—read only the first occurrence of a repeated header. Consequently, these upstream services use the attacker-controlled IP address for all IP-dependent logic, including logging, rate limiting, access control, and geolocation.
This vulnerability enables attackers to bypass IP-based security controls by impersonating trusted IP ranges (e.g., internal `10.0.0.0/8` networks), circumvent rate limiting, poison audit logs, and evade geofencing restrictions. The fix is straightforward: replace `Header.Add()` with `Header.Set()` at line 282 to ensure only the real client IP is forwarded to upstream servers.
<h2 style="color: blue;">DailyCVE Form:</h2>
Platform: GoFiber
Version: v2.x (all versions prior to fix)
Vulnerability: IP Spoofing (Header Injection)
Severity: Medium
date: 2026-07-02
<h2 style="color: blue;">Prediction: 2026-07-15</h2>
<h2 style="color: blue;">What Undercode Say:</h2>
Analytics: This vulnerability stems from improper HTTP header handling in the proxy middleware. The `Header.Add()` method is designed for multi-value headers (e.g., <code>X-Forwarded-For</code>), but `X-Real-IP` is intended to be a single-value header representing the client's real IP. Using `Add()` instead of `Set()` violates the expected semantics and introduces a vector for IP spoofing.
<h2 style="color: blue;">Bash Commands to Test:</h2>
[bash]
Send request with spoofed X-Real-IP header
curl -H "X-Real-IP: 10.0.0.1" http://target-app:8080/api/admin
Check if upstream server logs the spoofed IP
tail -f /var/log/nginx/access.log | grep "10.0.0.1"
Test rate limit bypass by sending multiple requests with spoofed IP
for i in {1..100}; do curl -H "X-Real-IP: 192.168.1.100" http://target-app:8080/api/endpoint; done
Vulnerable Code Snippet:
// middleware/proxy/proxy.go, lines 270-285
func BalancerForward(servers []string, clients ...fasthttp.Client) fiber.Handler {
r := &roundrobin{
current: 0,
pool: servers,
}
return func(c fiber.Ctx) error {
server := r.get()
if !strings.HasPrefix(server, "http") {
server = "http://" + server
}
// VULNERABLE: Add appends, does not replace
c.Request().Header.Add("X-Real-IP", c.IP())
return Do(c, server+c.OriginalURL(), clients...)
}
}
Exploit:
An attacker can exploit this vulnerability by crafting an HTTP request that includes a malicious `X-Real-IP` header pointing to a trusted IP address (e.g., 127.0.0.1, 10.0.0.1, or 192.168.1.1). When the GoFiber BalancerForward middleware proxies this request, it appends the real client IP as a second header value. The upstream server, which reads the first occurrence, treats the attacker as originating from the spoofed IP.
Example Attack Scenarios:
- Admin Panel Bypass: If an admin panel restricts access to
10.0.0.0/8, an attacker can set `X-Real-IP: 10.0.0.2` to gain unauthorized access. - Rate Limit Bypass: An attacker can rotate spoofed IP addresses to exhaust upstream rate limits, enabling brute-force attacks or DoS.
- Log Poisoning: Security incident response becomes unreliable as logs record spoofed IPs, masking the true attacker origin.
- Geolocation Evasion: IP-based geofencing can be circumvented by spoofing IPs from permitted regions.
Protection:
- Immediate Fix: Replace `Header.Add()` with `Header.Set()` in the BalancerForward function:
c.Request().Header.Set("X-Real-IP", c.IP()) - Upgrade Fiber: Update to the latest patched version of GoFiber that addresses this issue.
- Upstream Configuration: Configure upstream servers to read the last occurrence of repeated headers (if supported) or to ignore client-supplied `X-Real-IP` headers entirely.
- Proxy Trust Configuration: Enable `TrustProxy` in Fiber configuration and validate that only trusted proxies can set forwarding headers.
- Header Sanitization: Implement middleware to strip or override client-supplied `X-Real-IP` headers before they reach the BalancerForward handler.
Impact:
- Rate Limit Bypass: Attackers can perform unlimited requests by spoofing different IPs, undermining rate-limiting mechanisms.
- IP ACL Bypass: Internal IP allowlists (e.g.,
10.0.0.0/8,192.168.0.0/16) can be trivially bypassed, exposing administrative interfaces and internal APIs. - Audit Log Poisoning: Security logs record spoofed IPs, making forensic investigation and incident response unreliable.
- Geolocation Bypass: IP-based geofencing or regional access restrictions are circumvented, allowing attackers from restricted regions to access content.
- Authentication Bypass: If authentication relies on IP-based trust (e.g., zero-trust network policies), attackers can impersonate trusted internal hosts.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
