id: GO-2022-0463
modules:
    - module: github.com/astaxie/beego
      vulnerable_at: 1.12.3
      packages:
        - package: github.com/astaxie/beego
          symbols:
            - Tree.Match
          derived_symbols:
            - App.Run
            - ControllerRegister.FindPolicy
            - ControllerRegister.FindRouter
            - ControllerRegister.ServeHTTP
            - FilterRouter.ValidRouter
            - InitBeegoBeforeTest
            - Run
            - RunWithMiddleWares
            - TestBeegoInit
            - adminApp.Run
    - module: github.com/beego/beego
      versions:
        - fixed: 1.12.9
      vulnerable_at: 1.12.8
      packages:
        - package: github.com/beego/beego
          symbols:
            - Tree.match
          derived_symbols:
            - App.Run
            - ControllerRegister.FindPolicy
            - ControllerRegister.FindRouter
            - ControllerRegister.ServeHTTP
            - FilterRouter.ValidRouter
            - InitBeegoBeforeTest
            - Run
            - RunWithMiddleWares
            - TestBeegoInit
            - Tree.Match
            - adminApp.Run
    - module: github.com/beego/beego/v2
      versions:
        - fixed: 2.0.3
      vulnerable_at: 2.0.2
      packages:
        - package: github.com/beego/beego/v2/server/web
          symbols:
            - Tree.match
          derived_symbols:
            - AddNamespace
            - AddViewPath
            - Any
            - AutoPrefix
            - AutoRouter
            - BuildTemplate
            - Compare
            - CompareNot
            - Controller.Abort
            - Controller.Bind
            - Controller.BindForm
            - Controller.BindJSON
            - Controller.BindProtobuf
            - Controller.BindXML
            - Controller.BindYAML
            - Controller.CheckXSRFCookie
            - Controller.CustomAbort
            - Controller.Delete
            - Controller.DestroySession
            - Controller.Get
            - Controller.GetBool
            - Controller.GetFile
            - Controller.GetFloat
            - Controller.GetInt
            - Controller.GetInt16
            - Controller.GetInt32
            - Controller.GetInt64
            - Controller.GetInt8
            - Controller.GetSecureCookie
            - Controller.GetString
            - Controller.GetStrings
            - Controller.GetUint16
            - Controller.GetUint32
            - Controller.GetUint64
            - Controller.GetUint8
            - Controller.Head
            - Controller.Input
            - Controller.IsAjax
            - Controller.JSONResp
            - Controller.Options
            - Controller.ParseForm
            - Controller.Patch
            - Controller.Post
            - Controller.Put
            - Controller.Redirect
            - Controller.Render
            - Controller.RenderBytes
            - Controller.RenderString
            - Controller.Resp
            - Controller.SaveToFile
            - Controller.SaveToFileWithBuffer
            - Controller.ServeFormatted
            - Controller.ServeJSON
            - Controller.ServeJSONP
            - Controller.ServeXML
            - Controller.ServeYAML
            - Controller.SessionRegenerateID
            - Controller.SetData
            - Controller.SetSecureCookie
            - Controller.Trace
            - Controller.URLFor
            - Controller.XMLResp
            - Controller.XSRFFormHTML
            - Controller.XSRFToken
            - Controller.YamlResp
            - ControllerRegister.Add
            - ControllerRegister.AddAuto
            - ControllerRegister.AddAutoPrefix
            - ControllerRegister.AddMethod
            - ControllerRegister.AddRouterMethod
            - ControllerRegister.Any
            - ControllerRegister.CtrlAny
            - ControllerRegister.CtrlDelete
            - ControllerRegister.CtrlGet
            - ControllerRegister.CtrlHead
            - ControllerRegister.CtrlOptions
            - ControllerRegister.CtrlPatch
            - ControllerRegister.CtrlPost
            - ControllerRegister.CtrlPut
            - ControllerRegister.Delete
            - ControllerRegister.FindPolicy
            - ControllerRegister.FindRouter
            - ControllerRegister.Get
            - ControllerRegister.GetContext
            - ControllerRegister.Handler
            - ControllerRegister.Head
            - ControllerRegister.Include
            - ControllerRegister.Init
            - ControllerRegister.InsertFilter
            - ControllerRegister.Options
            - ControllerRegister.Patch
            - ControllerRegister.Post
            - ControllerRegister.Put
            - ControllerRegister.ServeHTTP
            - ControllerRegister.URLFor
            - CtrlAny
            - CtrlDelete
            - CtrlGet
            - CtrlHead
            - CtrlOptions
            - CtrlPatch
            - CtrlPost
            - CtrlPut
            - Date
            - DateFormat
            - DateParse
            - Delete
            - Exception
            - ExecuteTemplate
            - ExecuteViewPathTemplate
            - FileSystem.Open
            - FilterRouter.ValidRouter
            - FlashData.Error
            - FlashData.Notice
            - FlashData.Set
            - FlashData.Store
            - FlashData.Success
            - FlashData.Warning
            - Get
            - GetConfig
            - HTML2str
            - Handler
            - Head
            - Htmlquote
            - Htmlunquote
            - HttpServer.Any
            - HttpServer.AutoPrefix
            - HttpServer.AutoRouter
            - HttpServer.CtrlAny
            - HttpServer.CtrlDelete
            - HttpServer.CtrlGet
            - HttpServer.CtrlHead
            - HttpServer.CtrlOptions
            - HttpServer.CtrlPatch
            - HttpServer.CtrlPost
            - HttpServer.CtrlPut
            - HttpServer.Delete
            - HttpServer.Get
            - HttpServer.Handler
            - HttpServer.Head
            - HttpServer.Include
            - HttpServer.InsertFilter
            - HttpServer.LogAccess
            - HttpServer.Options
            - HttpServer.Patch
            - HttpServer.Post
            - HttpServer.PrintTree
            - HttpServer.Put
            - HttpServer.RESTRouter
            - HttpServer.Router
            - HttpServer.RouterWithOpts
            - HttpServer.Run
            - Include
            - InitBeegoBeforeTest
            - InsertFilter
            - LoadAppConfig
            - LogAccess
            - MapGet
            - Namespace.Any
            - Namespace.AutoPrefix
            - Namespace.AutoRouter
            - Namespace.Cond
            - Namespace.CtrlAny
            - Namespace.CtrlDelete
            - Namespace.CtrlGet
            - Namespace.CtrlHead
            - Namespace.CtrlOptions
            - Namespace.CtrlPatch
            - Namespace.CtrlPost
            - Namespace.CtrlPut
            - Namespace.Delete
            - Namespace.Filter
            - Namespace.Get
            - Namespace.Handler
            - Namespace.Head
            - Namespace.Include
            - Namespace.Namespace
            - Namespace.Options
            - Namespace.Patch
            - Namespace.Post
            - Namespace.Put
            - Namespace.Router
            - NewControllerRegister
            - NewControllerRegisterWithCfg
            - NewHttpServerWithCfg
            - NewHttpSever
            - NewNamespace
            - NotNil
            - Options
            - ParseForm
            - Patch
            - Policy
            - Post
            - PrintTree
            - Put
            - RESTRouter
            - ReadFromRequest
            - RenderForm
            - Router
            - RouterWithOpts
            - Run
            - RunWithMiddleWares
            - TestBeegoInit
            - Tree.AddRouter
            - Tree.AddTree
            - Tree.Match
            - URLFor
            - URLMap.GetMap
            - URLMap.GetMapData
            - Walk
            - adminApp.Run
            - adminController.AdminIndex
            - adminController.Healthcheck
            - adminController.ListConf
            - adminController.ProfIndex
            - adminController.PrometheusMetrics
            - adminController.QpsIndex
            - adminController.TaskStatus
            - beegoAppConfig.Bool
            - beegoAppConfig.DefaultBool
            - beegoAppConfig.SaveConfigFile
            - beegoAppConfig.Unmarshaler
summary: |-
    Access control bypass due to broad route matching in github.com/beego/beego and
    beego/v2
description: |-
    Routes in the beego HTTP router can match unintended patterns. This overly-broad
    matching may permit an attacker to bypass access controls.

    For example, the pattern "/a/b/:name" can match the URL "/a.xml/b/". This may
    bypass access control applied to the prefix "/a/".
published: 2022-07-01T20:06:59Z
cves:
    - CVE-2022-31259
ghsas:
    - GHSA-qx32-f6g6-fcfr
references:
    - fix: https://github.com/beego/beego/pull/4958
    - fix: https://github.com/beego/beego/commit/64cf44d725c8cc35d782327d333df9cbeb1bf2dd
    - web: https://beego.vip
    - web: https://github.com/beego/beego/issues/4946
    - web: https://github.com/beego/beego/pull/4954