PT-2023-27914 · Gofiber · Gofiber

Schicho · Published 2023-09-08 · Updated 2023-09-12 · CVE-2023-41338

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions gofiber versions prior to 2.49.2

Description The issue impacts users who rely on the ctx.IsFromLocal method to restrict access to localhost requests. If exploited, it could allow unauthorized access to resources intended only for localhost. Setting X-Forwarded-For: 127.0.0.1 in a request from a foreign host will result in true for ctx.IsFromLocal. Access is limited to the scope of the affected process.

Recommendations To resolve the issue, upgrade to version 2.49.2 or later, as this issue has been patched in version 2.49.2 with commit b8c9ede6. As a temporary workaround, consider restricting the use of the ctx.IsFromLocal method until a patch is available. Avoid using the X-Forwarded-For header in requests to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-670

Related Identifiers

CVE-2023-41338

GHSA-3Q5P-3558-364F

GO-2023-2052

Affected Products

Gofiber

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41338.json · Exploit
• https://github.com/gofiber/fiber/security/advisories/GHSA-3q5p-3558-364f · Vendor Advisory
• https://github.com/gofiber/fiber/commit/b8c9ede6efa231116c4bd8bb9d5e03eac1cb76dc · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-41338 · Security Note
• https://osv.dev/vulnerability/CVE-2023-41338 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-2052 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3q5p-3558-364f · Vendor Advisory
• https://github.com/gofiber/fiber · Note
• https://twitter.com/CVEnew/status/1700216981293568055 · Twitter Post
• https://docs.gofiber.io/api/ctx#isfromlocal · Note
• https://t.me/cibsecurity/70163 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1700248885313028178 · Twitter Post
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For · Note