PT-2019-10198 · Olivier Poitrey · Go Cors Handler

Published 2019-01-28 · Updated 2023-06-08 · CVE-2018-20744

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Olivier Poitrey Go CORS handler versions 1.3.0 and earlier

Description: The issue arises from the active conversion of a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible with the CORS security design. This incompatibility could lead to CORS misconfiguration security problems.

Recommendations: For versions 1.3.0 and earlier, consider disabling the CORS handler until a patch is available to prevent potential CORS misconfiguration security problems. Restrict access to the CORS policy configuration to minimize the risk of exploitation. Avoid using wildcard CORS policies in the affected handler until the issue is resolved.

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

CVE-2018-20744

GHSA-927H-X4QJ-R242

GO-2023-1792

Affected Products

Go Cors Handler

References · 12

• https://osv.dev/vulnerability/GHSA-927h-x4qj-r242 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-20744 · Security Note
• https://osv.dev/vulnerability/GO-2023-1792 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-20744 · Vendor Advisory
• https://github.com/gofiber/fiber · Note
• https://github.com/gofiber/fiber/pull/2339 · Note
• https://github.com/gofiber/fiber/issues/2338 · Note
• https://github.com/rs/cors/pull/57 · Note
• https://github.com/rs/cors/issues/55 · Note
• https://usenix.org/system/files/conference/usenixsecurity18/sec18-chen.pdf · Note
• http://securityfocus.com/bid/106834 · Note
• https://web.archive.org/web/20200227091122/http://securityfocus.com/bid/106834 · Note