logo

Database

Insufficient data authenticity validation In codeigniter4/framework

Description

CodeIgniter4 allows spoofing of IP address when using proxy

Impact

This vulnerability may allow attackers to spoof their IP address when your server is behind a reverse proxy.

Patches

Upgrade to v4.2.11 or later, and configure Config\App::$proxyIPs.

Workarounds

Do not use $request->getIPAddress().

References

For more information

If you have any questions or comments about this advisory:

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2022-235562. NVD-2022-235563. OSV-2022-235564. GHSA-ghw3-5qvm-3mqc5. GCVE-2022-235566. GHSA-ghw3-5qvm-3mqc

References

1. https://github.com/codeigniter4/CodeIgniter4/commit/5ca8c99b2db09a2a08a013836628028ddc9846592. https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-ghw3-5qvm-3mqc3. https://codeigniter4.github.io/userguide/incoming/request.html#CodeIgniter\HTTP\Request::getIPAddress4. https://github.com/FriendsOfPHP/security-advisories/blob/master/codeigniter4/framework/CVE-2022-23556.yaml

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.

FLAT-E0DMB – Vulnerability | Fluid Attacks Database