PT-2020-14193 · Fiber · Fiber

Abdshaleh + 2 · Published 2020-07-20 · Updated 2021-10-07 · CVE-2020-15111

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Fiber versions prior to 1.12.6

Description The issue arises from improper input sanitization in the c.Attachment() function, allowing a maliciously constructed filename to inject additional headers into an HTTP response. This can lead to a CRLF injection attack, where an attacker could upload a custom filename, change the name of the downloaded file, redirect to another site, or change the authorization header.

Recommendations For versions prior to 1.12.6, a possible workaround is to serialize the input before passing it to ctx.Attachment(). This issue has been patched in version 1.12.6, so updating to this version or later will resolve the issue.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

CWE-93

Related Identifiers

CVE-2020-15111

GHSA-9CX9-X2GP-9QVH

GO-2021-0108

Affected Products

Fiber

References · 10

• https://github.com/gofiber/fiber/pull/579/commits/f698b5d5066cfe594102ae252cd58a1fe57cf56f · Patch
• https://osv.dev/vulnerability/GHSA-9cx9-x2gp-9qvh · Vendor Advisory
• https://osv.dev/vulnerability/GO-2021-0108 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15111 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15111 · Security Note
• https://github.com/gofiber/fiber · Note
• https://github.com/gofiber/fiber/security/advisories/GHSA-9cx9-x2gp-9qvh · Note
• https://github.com/gofiber/fiber/pull/579 · Note
• https://github.com/gofiber/fiber/commit/f698b5d5066cfe594102ae252cd58a1fe57cf56f · Note
• https://pkg.go.dev/vuln/GO-2021-0108 · Note