GitHub Advisoryadvisory · Go

GHSA-mj9r-wwm8-7q52 Open Redirect in github.com/AndrewBurian/powermux

MEDIUM Published 2021-07-01 Modified 2024-05-20 Official page ↗
Aliases
CVE-2021-32721
Ecosystem
Go
Packages
github.com/AndrewBurian/powermux
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-601
Reviewed
2021-06-30

Affected packages

• Go github.com/AndrewBurian/powermux: < 1.1.1 → fixed in 1.1.1

Description

Impact Attackers may be able to craft phishing links and other open redirects by exploiting the trailing slash redirection feature. This may lead to users being redirected to untrusted sites after following an attacker crafted link. Patches The issue is resolved in v1.1.1 Workarounds There are no existing workarounds. You may detect attempts to craft urls that exploit this feature by looking for request paths containing pairs of forward slashes in sequence combined with a trailing slash e.g. `https://example.com//foo/`

Related

Alias · CVE (1)

  • CVE-2021-32721 PowerMux is a drop-in replacement for Go's http.ServeMux. vulnerability

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References