PT-2022-7187 · Labstack+1 · Labstack Echo+1

Ruokeqx · Published 2022-09-28 · Updated 2022-10-11 · CVE-2022-40083

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Labstack Echo version 4.8.0

Description The issue is related to an open redirect vulnerability via the Static Handler component, which can be leveraged by attackers to cause a Server-Side Request Forgery (SSRF). This allows a remote attacker to perform an SSRF attack by redirecting to an untrusted site.

Recommendations For Labstack Echo version 4.8.0, update to version 4.9.0 to resolve the issue. As a temporary workaround, consider restricting access to the Static Handler component to minimize the risk of exploitation.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

BDU:2023-08980

CVE-2022-40083

GHSA-CRXJ-HRMP-4RWF

GO-2022-1031

Affected Products

Debian

Labstack Echo

References · 18

• 🔥 https://github.com/labstack/echo/issues/2259 · Exploit
• https://osv.dev/vulnerability/CVE-2022-40083 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-40083 · Security Note
• https://ubuntu.com/security/CVE-2022-40083 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-40083 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-1031 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-40083 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-crxj-hrmp-4rwf · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08980 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-40083 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-40083 · Security Note
• https://github.com/labstack/echo · Note
• https://github.com/labstack/echo/pull/2260 · Note
• https://github.com/labstack/echo/commit/0ac4d74402391912ff6da733bb09fd4c3980b4e1 · Note
• https://github.com/labstack/echo/pull/2260/commits/3154abd1401554fe4d1c09ec550506d8625fc042 · Note