GHSA-vhxv-fg4m-p2w8: Some CORS middleware allow untrusted origins
Impact Some CORS middleware (more specifically those created by specifying two or more origin patterns whose hosts share a proper suffix) incorrectly allow some untrusted origins, thereby opening the door to cross-origin attacks from the untrusted origins in question.
Published May 3, 2024 · Updated May 21, 2024
Affected packages
github.com/jub0bs/cors
- Ecosystem
- Go
- Affected
- < 0.1.3
- Fixed in
- 0.1.3
- Check
go list -m github.com/jub0bs/cors
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Impact
Some CORS middleware (more specifically those created by specifying two or more origin patterns whose hosts share a proper suffix) incorrectly allow some untrusted origins, thereby opening the door to cross-origin attacks from the untrusted origins in question.
For example, specifying origin patterns https://foo.com and https://bar.com (in that order) would yield a middleware that would incorrectly allow untrusted origin https://barfoo.com.
Patches
Patched in v0.1.3.
Workarounds
None.
Credited to jub0bs.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology