GitHub Advisoryadvisory · Go
GHSA-vhxv-fg4m-p2w8 Some CORS middleware allow untrusted origins
CRITICAL
Official page ↗
- Ecosystem
- Go
- Packages
- github.com/jub0bs/cors
- Severity
- Critical
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
- Reviewed
- 2024-05-03
Affected packages
• Go github.com/jub0bs/cors: < 0.1.3 → fixed in 0.1.3
Description
Impact
Some CORS middleware (more specifically those created by specifying two or more origin patterns whose hosts share a proper suffix) incorrectly allow some untrusted origins, thereby opening the door to cross-origin attacks from the untrusted origins in question.
For example, specifying origin patterns `https://foo.com` and `https://bar.com` (in that order) would yield a middleware that would incorrectly allow untrusted origin `https://barfoo.com`.
Patches
Patched in v0.1.3.
Workarounds
None.