Exploit for CVE-2026-72815-poc

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-SAKU0512-CVE-2026-72815-POC
# CVE-2026-72815: go-chi/chi `middleware.RealIP` IP Spoofing PoC

日本語版

## Overview

This repository contains a local Proof of Concept (PoC) for **CVE-2026-72815** (GHSA-3fxj-6jh8-hvhx), an IP spoofing vulnerability in go-chi/chi's `middleware.RealIP`.

The vulnerable middleware blindly trusts the first (leftmost) value of the `X-Forwarded-For` header and overwrites `http.Request.RemoteAddr` with it. If a client-controlled forwarding header reaches the application, an attacker may spoof an arbitrary source IP and potentially bypass IP-based ACLs or rate limits, or forge audit log entries.

The PoC uses only Go's `httptest` package. It does not send requests to external hosts.

## Disclaimer

Use this project only for educational purposes and authorized security testing. Do not use it against systems without permission.

## Vulnerability details

  * **CVE ID:** CVE-2026-72815
  * **GitHub Advisory:** GHSA-3fxj-6jh8-hvhx
  * **Product:** `github.com/go-chi/chi/v5`
  * **Vulnerable API:** `middleware.RealIP`
  * **Weakness:** Authentication Bypass by Spoofing (CWE-290)
  * **CVSS v4.0:** 6.9 (Moderate)
  * **Affected range in the CVE record:** `>= 5.2.1, < 5.3.0`
  * **Patched version:** `5.3.0`



### Root cause

When `X-Forwarded-For` is present, `middleware.RealIP` takes the first comma-separated value and uses it as `RemoteAddr`.

Conceptually:

root@kitploit:~
    
    
    if xff := r.Header.Get("X-Forwarded-For"); xff != "" {
        ip, _, _ = strings.Cut(xff, ",")
    }
    
    r.RemoteAddr = ip
    

A reverse proxy commonly appends the actual source IP to an existing XFF chain. Therefore, the leftmost value can be attacker-controlled. For example:

root@kitploit:~
    
    
    X-Forwarded-For: 127.0.0.1, 203.0.113.50
    

The vulnerable `RealIP` middleware treats `127.0.0.1` as the client IP.

## Proof of Concept

### Requirements

  * Go 1.23 or later (the standalone v5.2.1 vulnerable case works with Go 1.20 or later)
  * Network access for the initial module download



### 1\. Reproduce with vulnerable v5.2.1

root@kitploit:~
    
    
    cd vulnerable
    GOWORK=off go run .
    

The PoC simulates `203.0.113.50` as the real client and `127.0.0.1` as an administrator IP allowed by an ACL.

A normal request is denied with HTTP 403. A spoofed request supplies:

root@kitploit:~
    
    
    X-Forwarded-For: 127.0.0.1, 203.0.113.50
    

`RealIP` rewrites `RemoteAddr` to `127.0.0.1`, causing the same request to receive HTTP 200.

Expected key output:

root@kitploit:~
    
    
    === CVE-2026-72815 vulnerable case ===
    [*] go-chi/chi version: v5.2.1
    [*] normal request status: 403
    [*] spoofed request status: 200
    [!] VULNERABLE: attacker-controlled X-Forwarded-For bypassed the IP ACL.
    

### 2\. Safe replacement in v5.3.0

root@kitploit:~
    
    
    cd fixed
    GOWORK=off go run .
    

v5.3.0 introduced `ClientIPFromHeader`, `ClientIPFromXFF`, `ClientIPFromXFFTrustedProxies`, and `ClientIPFromRemoteAddr` as explicit replacements for `RealIP`.

The fixed example models a deployment with exactly one trusted reverse proxy that appends the actual client IP to the XFF chain. It therefore uses `ClientIPFromXFF()`. With the same spoofed input, the rightmost `203.0.113.50` is selected and the ACL remains denied.

Expected key output:

root@kitploit:~
    
    
    === CVE-2026-72815 safe replacement case ===
    [*] go-chi/chi version: v5.3.0
    [*] normal request status: 403
    [*] spoofed request status: 403
    [+] SAFE: the spoofed leftmost X-Forwarded-For value did not bypass the IP ACL.
    

### 3\. Run both cases

root@kitploit:~
    
    
    bash scripts/run-version-matrix.sh
    

## Important note about v5.3.0

For backward compatibility, **the legacy`middleware.RealIP` behavior still exists in v5.3.0**. It is deprecated and documentation directs users to the new `ClientIPFrom*` APIs.

Therefore, upgrading the dependency alone is not sufficient if an application continues to use `middleware.RealIP`. Migrate to the `ClientIPFrom*` middleware that matches the actual network and reverse-proxy topology.

## Scope

This repository demonstrates only:

  1. attacker control of the leftmost XFF value reaching `middleware.RealIP`;
  2. an IP-based ACL bypass caused by the resulting `RemoteAddr` rewrite; and
  3. rejection of the same spoofed input when the appropriate v5.3.0 client-IP API is used.



It does not scan networks, contact third-party services, perform denial of service, or establish persistence.

## Mitigation

  * Upgrade go-chi/chi to **v5.3.0 or later**.
  * Replace `middleware.RealIP` with the appropriate `ClientIPFrom*` middleware for your infrastructure.
  * Configure reverse proxies to overwrite or remove untrusted forwarding headers as appropriate.
  * Do not use the source IP as the sole basis for high-value authentication or authorization decisions.



## References

  * CVE-2026-72815
  * GHSA-3fxj-6jh8-hvhx
  * go-chi/chi PR #967: middleware.ClientIP
  * go-chi/chi v5.3.0