id: GO-2024-2604
modules:
    - module: github.com/zeromicro/go-zero
      versions:
        - fixed: 1.4.4
      vulnerable_at: 1.4.3
      packages:
        - package: github.com/zeromicro/go-zero/rest/internal/cors
          symbols:
            - isOriginAllowed
summary: CORS Filter bypass in github.com/zeromicro/go-zero
description: |-
    The CORS Filter feature in go-zero allows users to specify an array of domains
    allowed in the CORS policy. However, the isOriginAllowed function uses
    strings.HasSuffix to check the origin, which can lead to a bypass via a domain
    like "evil-victim.com". This vulnerability is capable of breaking CORS policy
    and thus allowing any page to make requests and retrieve data on behalf of other
    users.
cves:
    - CVE-2024-27302
ghsas:
    - GHSA-fgxv-gw55-r5fq
credits:
    - cokeBeer
references:
    - advisory: https://github.com/zeromicro/go-zero/security/advisories/GHSA-fgxv-gw55-r5fq
    - fix: https://github.com/zeromicro/go-zero/commit/d9d79e930dff6218a873f4f02115df61c38b15db