Vulnerability Report: GO-2024-2574
- CVE-2024-25124, GHSA-fmg4-x8pw-hjhg
- Affects: github.com/gofiber/fiber/v2
- Published: May 20, 2024
The CORS middleware allows for insecure configurations that could potentially expose the application to multiple CORS-related vulnerabilities. Specifically, it allows setting the Access-Control-Allow-Origin header to a wildcard ("*") while also having the Access-Control-Allow-Credentials set to true, which goes against recommended security best practices.
For detailed information about this vulnerability, visit https://github.com/gofiber/fiber/security/advisories/GHSA-fmg4-x8pw-hjhg.
Affected Packages
-
PathVersionsSymbols
-
before v2.52.1
Aliases
References
- https://github.com/gofiber/fiber/security/advisories/GHSA-fmg4-x8pw-hjhg
- https://github.com/gofiber/fiber/commit/f0cd3b44b086544a37886232d0530601f2406c23
- http://blog.portswigger.net/2016/10/exploiting-cors-misconfigurations-for.html
- https://codeql.github.com/codeql-query-help/javascript/js-cors-misconfiguration-for-credentials
- https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS/Errors/CORSNotSupportingCredentials
- https://fetch.spec.whatwg.org/#cors-protocol-and-credentials
- https://github.com/gofiber/fiber/releases/tag/v2.52.1
- https://saturncloud.io/blog/cors-cannot-use-wildcard-in-accesscontrolalloworigin-when-credentials-flag-is-true
- https://vuln.go.dev/ID/GO-2024-2574.json
Feedback
See anything missing or incorrect?
Suggest an edit to this report.