PT-2025-16379 · Unknown+2 · Gorilla/Csrf+2

Patrickod · Published 2025-04-14 · Updated 2025-08-29 · CVE-2025-24358

Positive Technologies (AI Summary)

CVSS v4.0

6.0

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions gorilla/csrf versions prior to 1.7.2

Description The issue concerns a Cross Site Request Forgery (CSRF) prevention middleware for Go web applications and services. It does not validate the Origin header against an allowlist prior to version 1.7.2. The validation of the Referer header for cross-origin requests is executed only when the request is believed to be served over TLS, determined by inspecting the r.URL.Scheme value. However, this value is never populated for "server" requests per the Go spec, making the check ineffective. This allows an attacker with XSS on a subdomain or top-level domain to perform authenticated form submissions against protected targets sharing the same top-level domain.

Recommendations For versions prior to 1.7.2, update to version 1.7.2 to fix the issue. As a temporary workaround, consider restricting access to sensitive form submissions to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2025-11753

CVE-2025-24358

DLA-4151-1

GHSA-RQ77-P4H8-4CRW

GO-2025-3607

OPENSUSE-SU-2025:15017-1

Affected Products

Debian

Red Os

Gorilla/Csrf

References · 49

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24358.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-24358 · Security Note
• https://ubuntu.com/security/CVE-2025-24358 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-11753 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-24358 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-24358 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rq77-p4h8-4crw · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-24358 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3607 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-24358 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4151-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-24358 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15017-1 · Vendor Advisory
• https://github.com/gorilla/csrf/commit/9dd6af1f6d30fc79fb0d972394deebdabad6b5eb · Note
• https://github.com/gorilla/csrf/security/advisories/GHSA-rq77-p4h8-4crw · Note