PT-2024-28042 · Gofiber · Gofiber

Renewerner87 · Published 2024-07-01 · Updated 2025-10-02 · CVE-2024-38513

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GoFiber versions prior to 2.52.5

Description A session middleware issue in GoFiber versions 2 and above allows users to supply their own session id value, resulting in the creation of a session with that key. If a website relies on the mere presence of a session for security purposes, this can lead to significant security risks, including unauthorized access and session fixation attacks. All users utilizing GoFiber's session middleware in the affected versions are impacted.

Recommendations To mitigate this issue, users are strongly encouraged to upgrade to version 2.52.5 or higher. For users who are unable to upgrade immediately, either implement additional validation to ensure session ids are not supplied by the user and are securely generated by the server, or regularly rotate session ids and enforce strict session expiration policies.

Exploit

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2024-38513

GHSA-98J2-3J3P-FW2V

GO-2024-2959

Affected Products

Gofiber

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/38xxx/CVE-2024-38513.json · Exploit
• https://github.com/gofiber/fiber/commit/66a881441b27322a331f1b526cf1eb6b3358a4d8 · Patch
• https://github.com/gofiber/fiber/security/advisories/GHSA-98j2-3j3p-fw2v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-38513 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-38513 · Security Note
• https://osv.dev/vulnerability/GO-2024-2959 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-98j2-3j3p-fw2v · Vendor Advisory
• https://github.com/gofiber/fiber · Note
• https://github.com/gofiber/fiber/commit/7926e5bf4da03e54f62d27d53229d35b264cba8e · Note
• https://t.me/cvenotify/84948 · Telegram Post
• https://twitter.com/fletch_ai/status/1809497668475056555 · Twitter Post
• https://twitter.com/cracbot/status/1809105089162063957 · Twitter Post
• https://t.me/cveNotify/137170 · Telegram Post
• https://t.me/pentestingnews/48821 · Telegram Post
• https://twitter.com/vipr_lab/status/1809114659284238705 · Twitter Post