CVE-2022-32148

What it actually does

A flaw in Go's `net/http/httputil.ReverseProxy` allows for the improper exposure of a client's IP address. When the `ServeHTTP` function is called with a `Request.Header` map containing a `nil` value for the `X-Forwarded-For` header, the reverse proxy incorrectly sets the client's IP address as the value of this header. This bypasses the intended behavior of a reverse proxy, which is often to mask or manage the client's IP, and leaks it to the backend service.

Why it matters to the business

This vulnerability can lead to the violation of user privacy and data protection regulations like GDPR by exposing user IP addresses that were intended to be anonymized. This exposure can break trust with users who expect their information to be private. Furthermore, it can reveal the internal network topology if internal clients are accessing services through the proxy, providing valuable reconnaissance information to attackers and increasing the risk of further targeted attacks.

How an attack unfolds

An attacker targets an application using a vulnerable Go-based reverse proxy. The attacker sends a crafted request that, due to application logic or other middleware, results in the `X-Forwarded-For` header value being set to `nil` within the Go `Request.Header` map. This is not a standard HTTP request but an internal state. When the vulnerable `httputil.ReverseProxy` instance processes this request, it fails to handle the `nil` value correctly. Instead of ignoring it, the proxy populates the `X-Forwarded-For` header with the connecting client's real IP address before forwarding the request. The backend service, which should only see the proxy's IP, now receives the client's true IP, achieving the information leak.

How to fix it

To remediate this vulnerability, developers must upgrade the Go language version used to build their applications and then recompile and redeploy them. Upgrade to Go version 1.17.12 or 1.18.4, or any later version. Simply upgrading the Go runtime on a server is not sufficient; the specific application binaries must be rebuilt with a patched toolchain.

How to confirm the fix worked

To validate the fix, check the version of the Go toolchain used to compile your applications. Use the command `go version <path_to_binary>` to inspect the build information of a binary. Ensure the version is 1.17.12, 1.18.4, or newer. Additionally, developers can write a unit test that creates an `http.Request` with `Header: {"X-Forwarded-For": nil}`, passes it to a `ReverseProxy`, and asserts that the request forwarded to the backend handler does not contain the client's IP in the `X-Forwarded-For` header.

Typical attack path

1. An attacker identifies a web service using a reverse proxy built with a vulnerable version of Go.
2. The attacker crafts a request that causes the application to create an `http.Request` object where the `X-Forwarded-For` header has a `nil` value.
3. The request is passed to the `httputil.ReverseProxy`.
4. The vulnerable proxy code appends the client's real IP address to the `X-Forwarded-For` header.
5. The request, now containing the client's IP, is forwarded to the backend service.
6. The backend service processes the request, and the client's IP is logged or used by the backend application, completing the information disclosure.

How to detect it

Detecting past exploitation is challenging as it relies on a transient in-memory state (`nil` header value) that is not typically logged. The most effective way to detect exposure is to identify vulnerable software versions. Check application binaries to see which version of Go they were compiled with. On backend servers, you could look for anomalous entries in access logs where the `X-Forwarded-For` header contains external IP addresses from clients that should have been masked by the proxy, but this is not a definitive indicator of exploitation.

What your security team should do

• Use software composition analysis (SCA) or binary analysis tools to identify all applications built with vulnerable Go versions (prior to 1.17.12 and 1.18.4) that utilize the `net/http/httputil` package.
• Direct the responsible development teams to upgrade their Go compiler, recompile affected applications, and deploy the patched versions.
• Review network architecture to ensure defense-in-depth, so that the leak of a client IP address does not immediately lead to a more critical security failure.