Vulnerability Details : CVE-2022-32148
Potential exploit
Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For header.
Vulnerability category: Information leak
Products affected by CVE-2022-32148
- cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
- cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-32148
0.05%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 17 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-32148
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.5
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
3.9
|
2.5
|
NIST |
CWE ids for CVE-2022-32148
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: security@golang.org (Secondary)
References for CVE-2022-32148
-
https://go.googlesource.com/go/+/b2cc0fecc2ccd80e6d5d16542cc684f97b3a9c8a
b2cc0fecc2ccd80e6d5d16542cc684f97b3a9c8a - go - Git at GoogleMailing List;Patch
-
https://go.dev/cl/412857
net/http: preserve nil values in Header.Clone (Ice369cdb) · Gerrit Code ReviewPatch
-
https://pkg.go.dev/vuln/GO-2022-0520
GO-2022-0520 - Go PackagesVendor Advisory
-
https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE
[security] Go 1.18.4 and Go 1.17.12 are releasedMailing List;Release Notes
-
https://go.dev/issue/53423
net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working · Issue #53423 · golang/go · GitHubExploit;Issue Tracking;Third Party Advisory
Jump to