GHSA-h9g5-28mm-hx3g Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob

• Go github.com/labstack/echo/v5: < 5.4.0 → fixed in 5.4.0 • Go github.com/labstack/echo/v4: < 4.16.0 → fixed in 4.16.0

Summary The `Context.JSONP`, `Context.JSONPBlob`, and internal `jsonPBlob` helper in `context.go` directly concatenate the caller-supplied `callback` parameter into a JavaScript response without any validation, escaping, or allow-listing. This creates a high-impact reflected XSS that can be triggered by any route passing attacker-controlled data (query string, form, header, path param, etc.) into the callback. Present in current master and v5.1.0 (latest release). Vulnerable Code (verbatim) ```go func (c *Context) jsonPBlob(code int, callback string, i any) (err error) { c.writeContentType(MIMEApplicationJavaScriptCharsetUTF8) c.response.WriteHeader(code) if _, err = c.response.Write([]byte(callback + "(")); err != nil { return } if err = c.echo.JSONSerializer.Serialize(c, i, ""); err != nil { return } if _, err = c.response.Write([]byte(");")); err != nil { return } return } func (c *Context) JSONP(code int, callback string, i any) (err error) { return c.jsonPBlob(code, callback, i) } func (c *Context) JSONPBlob(code int, callback string, b []byte) (err error) { c.writeContentType(MIMEApplicationJavaScriptCharsetUTF8) c.response.WriteHeader(code) if _, err = c.response.Write([]byte(callback + "(")); err != nil { return } if _, err = c.response.Write(b); err != nil { return } _, err = c.response.Write([]byte(");")) return } ``` No sanitization is performed on the callback string. Exploit (one-request repro) Any route using the official pattern is vulnerable: ``` Goe.GET("/api", func(c echo.Context) error { return c.JSONP(200, c.QueryParam("callback"), map[string]string{"status": "ok"}) }) ``` Attacker request: ``` GET /api?callback=alert(document.domain)%2f%2f HTTP/1.1 Host: target.com ``` Server response: ``` Content-Type: application/javascript; charset=utf-8 alert(document.domain)//({"status":"ok"}); ``` → Immediate arbitrary JavaScript execution (full reflected XSS). Impact • Session hijacking, cookie theft, account takeover, keylogging, defacement. • Works even with strict CSP (response is served as application/javascript). Affected Versions • All versions ≤ v5.1.0 (including current master) Workarounds Manually sanitize the callback before calling JSONP/JSONPBlob: ``` Gofunc safeCallback(cb string) string { if matched, _ := regexp.MatchString(`^[a-zA-Z0-9_.\[\]]+$`, cb); !matched { return "callback" } return cb } ``` Or migrate away from JSONP entirely (use CORS + application/json). References • https://github.com/labstack/echo/blob/master/context.go • https://echo.labstack.com/docs/cookbook/jsonp Patches Fixed in `github.com/labstack/echo/v5` v5.4.0 and `github.com/labstack/echo/v4` v4.16.0. `Context.JSONP` and `Context.JSONPBlob` accept only a callback that is empty, a JavaScript identifier or a dot-separated path of identifiers (ASCII letters, digits, `_` and `$`); any other callback returns a 400 Bad Request error wrapping `ErrInvalidJSONPCallback` and nothing is written. JSONP responses also carry `X-Content-Type-Options: nosniff`. Workarounds Validate the callback in your handler before calling `Context.JSONP`, for example against `^[A-Za-z_$][A-Za-z0-9_$]*(\.[A-Za-z_$][A-Za-z0-9_$]*)*$`, and set `X-Content-Type-Options: nosniff`. JSONP responses can be read by any website with the user's cookies, so do not serve data that requires authentication through JSONP.