TsDProxy: X-Forwarded-For header injection allows IP spoofing in proxied requests to backend services

Description The HTTP reverse proxy handler in tsdproxy does not strip the X-Forwarded-For or X-Real-IP header from incoming requests before calling r.SetXForwarded. This allows an authenticated Tailscale user to inject arbitrary X-Forwarded-For values that are forwarded verbatim to backend...

PT-2023-27914 · Gofiber · Gofiber

Name of the Vulnerable Software and Affected Versions: gofiber versions prior to 2.49.2 Description: The issue impacts users who rely on the ctx.IsFromLocal method to restrict access to localhost requests. If exploited, it could allow unauthorized access to resources intended only for localhost...