CodeIgniter4 allows spoofing of IP address when using proxy

HIGH 7.5CVE-2022-23556 · BIT-codeigniter-2022-23556 · GHSA-ghw3-5qvm-3mqc · Published 22/12/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
codeigniter4/framework Packagist	`< 4.2.11`	`4.2.11`
codeigniter codeigniter	`≥ 4.0.0, < 4.2.11`	`4.2.11`

Description

Impact

This vulnerability may allow attackers to spoof their IP address when your server is behind a reverse proxy.

Patches

Upgrade to v4.2.11 or later, and configure Config\App::$proxyIPs.

Workarounds

Do not use $request->getIPAddress().

References

https://codeigniter4.github.io/userguide/incoming/request.html#CodeIgniter\HTTP\Request::getIPAddress

For more information

If you have any questions or comments about this advisory:

Open an issue in codeigniter4/CodeIgniter4
Email us at SECURITY.md

NVD description

CodeIgniter is a PHP full-stack web framework. This vulnerability may allow attackers to spoof their IP address when the server is behind a reverse proxy. This issue has been patched, please upgrade to version 4.2.11 or later, and configure `Config\App::$proxyIPs`. As a workaround, do not use `$request->getIPAddress()`.

References

codeigniter4/CodeIgniter4 security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2022-23556 · ADVISORY
codeigniter4/CodeIgniter4 commit 5ca8c99 · WEB
codeigniter4.github.io/userguide/incoming/request.html · WEB
FriendsOfPHP/security-advisories · WEB
codeigniter4/CodeIgniter4 · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

codeigniter4/framework

Packagist

< 4.2.11

4.2.11

codeigniter

≥ 4.0.0, < 4.2.11

4.2.11

Description

Impact

This vulnerability may allow attackers to spoof their IP address when your server is behind a reverse proxy.

Patches

Upgrade to v4.2.11 or later, and configure Config\App::$proxyIPs.

Workarounds

Do not use $request->getIPAddress().

References

https://codeigniter4.github.io/userguide/incoming/request.html#CodeIgniter\HTTP\Request::getIPAddress

For more information

If you have any questions or comments about this advisory:

Open an issue in codeigniter4/CodeIgniter4
Email us at SECURITY.md

NVD description