PT-2024-20765 · Fiber · Fiber
Gaby
·
Published
2024-02-21
·
Updated
2025-02-05
·
CVE-2024-25124
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Fiber versions prior to 2.52.1
Description
The issue is related to the CORS middleware in Fiber, which allows for insecure configurations. Specifically, it permits setting the Access-Control-Allow-Origin header to a wildcard (
*) while also having the Access-Control-Allow-Credentials set to true, which goes against recommended security best practices. This misconfiguration can lead to unauthorized access to sensitive user data and expose the system to various types of attacks. The impact of this issue is high.Recommendations
For Fiber versions prior to 2.52.1, as a temporary workaround, users may manually validate the CORS configurations in their implementation to ensure that they do not allow a wildcard origin when credentials are enabled.
For Fiber versions prior to 2.52.1, update to version 2.52.1 to resolve the issue.
Exploit
Fix
Origin Validation Error
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Fiber