PT-2025-35244 · Filippo.Io+4 · Filippo.Io/Csrf/Gorilla+5

Filippo Valsorda · Published 2025-08-29 · Updated 2025-08-29 · CVE-2025-47909

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Go (affected versions not specified)

Description Hosts listed in TrustedOrigins implicitly allow requests from the corresponding HTTP origins, potentially enabling network attackers to perform Cross-Site Request Forgery (CSRF) attacks. Following the fix for CVE-2025-24358, an attacker attempting to submit a form from http://example.com to https://example.com is prevented because the Origin header is validated against a synthetic URL using sameOrigin. However, adding a host to TrustedOrigins allows both its HTTP and HTTPS origins, as the schema of the synthetic URL is disregarded, and only the host is checked. For instance, if an application hosted on https://example.com adds example.net to TrustedOrigins, an attacker can serve a form at http://example.net to execute the attack.

Recommendations Migrate to net/http.CrossOriginProtection, introduced in Go 1.25. If migration to net/http.CrossOriginProtection is not feasible, utilize the backport available as a module at filippo.io/csrf. Employ the drop-in replacement for the github.com/gorilla/csrf API available at filippo.io/csrf/gorilla.

Fix

Origin Validation Error

CSRF

Weakness Enumeration

CWE-807

CWE-346

CWE-352

Related Identifiers

CVE-2025-47909

GHSA-82FF-HG59-8X73

GO-2025-3884

Affected Products

Debian

Go

Filippo.Io/Csrf

Filippo.Io/Csrf/Gorilla

Github.Com/Gorilla/Csrf

Net/Http

References · 15

• https://osv.dev/vulnerability/GHSA-82ff-hg59-8x73 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-47909 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-47909 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-47909 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-47909 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-47909 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3884 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-47909 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-47909 · Security Note
• https://github.com/gorilla/csrf · Note
• https://github.com/golang/vulndb/issues/3884 · Note
• https://twitter.com/CVEnew/status/1961463468395319482 · Twitter Post
• https://github.com/advisories/GHSA-82ff-hg59-8x73 · Note
• https://pkg.go.dev/vuln/GO-2025-3884 · Note
• https://twitter.com/VulmonFeeds/status/1961497640949985377 · Twitter Post