Threats affecting pkg:golang/github.com/go-chi/chi

go-chi chi versions 5.2.2 through 5.5.0 contain an open redirect vulnerability in the RedirectSlashes middleware. This flaw allows attackers to craft URLs with embedded tab characters that bypass existing fixes and redirect users to external hosts. The vulnerability exploits how browsers handle URL-encoded tabs in the 301 Location header, enabling protocol-relative URL redirection.

go-chi chi versions before 5.5.0 have an authentication bypass vulnerability in the middleware.SupressNotFound component. This flaw allows unauthenticated attackers to exploit the routing mechanism by requesting a mounted path that matches an outer public route suffix, thereby bypassing authentication middleware and potentially accessing tenant-scoped data.

chi versions before 5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware. This vulnerability arises because the middleware uses the Host header to construct redirect URLs, allowing attackers to manipulate the Host header to redirect users to arbitrary hosts. This can facilitate phishing attacks and credential theft. The advisory is a duplicate and has been withdrawn in favor of GHSA-vrw8-fxc6-2r93. No patch links are provided in this advisory, but the fixed version is 5.2.2.

go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP (Request.RemoteAddr) using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the first value of the X-Forwarded-For header to spoof the request source IP, potentially bypassing access controls or falsifying request logs.

go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go). The realIP() function reads client-controlled headers (True-Client-IP, X-Real-IP, and X-Forwarded-For) and overwrites r.RemoteAddr without verifying that the request originated from a trusted proxy. Attackers can supply arbitrary IP addresses in these headers to bypass IP-based access controls, evade rate limiting and geo-IP restrictions, and pollute audit logs. Fixed in 5.3.0.

go-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries, by supplying a spoofed IP address in the X-Forwarded-For header. The issue is fixed in version 5.3.0.