CodeIgniter4 allows spoofing of IP address when using proxy

高 7.5CVE-2022-23556 · BIT-codeigniter-2022-23556 · GHSA-ghw3-5qvm-3mqc · 22/12/2022 公開 · 17/06/2026 更新

要点

CVE-2022-23556 は codeigniter4/framework, codeigniter (codeigniter) に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.40%（全脆弱性の 34.0% より高い）。
対処：4.2.11 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
codeigniter4/framework Packagist	`< 4.2.11`	`4.2.11`
codeigniter codeigniter	`≥ 4.0.0, < 4.2.11`	`4.2.11`

概要

Impact

This vulnerability may allow attackers to spoof their IP address when your server is behind a reverse proxy.

Patches

Upgrade to v4.2.11 or later, and configure Config\App::$proxyIPs.

Workarounds

Do not use $request->getIPAddress().

References

https://codeigniter4.github.io/userguide/incoming/request.html#CodeIgniter\HTTP\Request::getIPAddress

For more information

If you have any questions or comments about this advisory:

Open an issue in codeigniter4/CodeIgniter4
Email us at SECURITY.md

NVD の説明

CodeIgniter is a PHP full-stack web framework. This vulnerability may allow attackers to spoof their IP address when the server is behind a reverse proxy. This issue has been patched, please upgrade to version 4.2.11 or later, and configure `Config\App::$proxyIPs`. As a workaround, do not use `$request->getIPAddress()`.