id: GO-2022-0572
modules:
    - module: github.com/astaxie/beego
      vulnerable_at: 1.12.3
      packages:
        - package: github.com/astaxie/beego
          symbols:
            - Tree.Match
          derived_symbols:
            - App.Run
            - ControllerRegister.FindPolicy
            - ControllerRegister.FindRouter
            - ControllerRegister.ServeHTTP
            - FilterRouter.ValidRouter
            - InitBeegoBeforeTest
            - Run
            - RunWithMiddleWares
            - TestBeegoInit
            - adminApp.Run
    - module: github.com/beego/beego
      vulnerable_at: 1.12.11
      packages:
        - package: github.com/beego/beego
          symbols:
            - Tree.Match
          derived_symbols:
            - App.Run
            - ControllerRegister.FindPolicy
            - ControllerRegister.FindRouter
            - ControllerRegister.ServeHTTP
            - FilterRouter.ValidRouter
            - InitBeegoBeforeTest
            - Run
            - RunWithMiddleWares
            - TestBeegoInit
            - adminApp.Run
    - module: github.com/beego/beego/v2
      versions:
        - introduced: 2.0.0
        - fixed: 2.0.3
      vulnerable_at: 2.0.1
      packages:
        - package: github.com/beego/beego/v2/server/web
          symbols:
            - Tree.Match
          derived_symbols:
            - AddNamespace
            - AddViewPath
            - Any
            - AutoPrefix
            - AutoRouter
            - BuildTemplate
            - Compare
            - CompareNot
            - Controller.Abort
            - Controller.CheckXSRFCookie
            - Controller.CustomAbort
            - Controller.Delete
            - Controller.DestroySession
            - Controller.Get
            - Controller.GetBool
            - Controller.GetFile
            - Controller.GetFloat
            - Controller.GetInt
            - Controller.GetInt16
            - Controller.GetInt32
            - Controller.GetInt64
            - Controller.GetInt8
            - Controller.GetSecureCookie
            - Controller.GetString
            - Controller.GetStrings
            - Controller.GetUint16
            - Controller.GetUint32
            - Controller.GetUint64
            - Controller.GetUint8
            - Controller.Head
            - Controller.Input
            - Controller.IsAjax
            - Controller.Options
            - Controller.ParseForm
            - Controller.Patch
            - Controller.Post
            - Controller.Put
            - Controller.Redirect
            - Controller.Render
            - Controller.RenderBytes
            - Controller.RenderString
            - Controller.SaveToFile
            - Controller.ServeFormatted
            - Controller.ServeJSON
            - Controller.ServeJSONP
            - Controller.ServeXML
            - Controller.ServeYAML
            - Controller.SessionRegenerateID
            - Controller.SetData
            - Controller.SetSecureCookie
            - Controller.Trace
            - Controller.URLFor
            - Controller.XSRFFormHTML
            - Controller.XSRFToken
            - ControllerRegister.Add
            - ControllerRegister.AddAuto
            - ControllerRegister.AddAutoPrefix
            - ControllerRegister.AddMethod
            - ControllerRegister.Any
            - ControllerRegister.Delete
            - ControllerRegister.FindPolicy
            - ControllerRegister.FindRouter
            - ControllerRegister.Get
            - ControllerRegister.GetContext
            - ControllerRegister.Handler
            - ControllerRegister.Head
            - ControllerRegister.Include
            - ControllerRegister.InsertFilter
            - ControllerRegister.InsertFilterChain
            - ControllerRegister.Options
            - ControllerRegister.Patch
            - ControllerRegister.Post
            - ControllerRegister.Put
            - ControllerRegister.ServeHTTP
            - ControllerRegister.URLFor
            - Date
            - DateFormat
            - DateParse
            - Delete
            - Exception
            - ExecuteTemplate
            - ExecuteViewPathTemplate
            - FileSystem.Open
            - FilterRouter.ValidRouter
            - FlashData.Error
            - FlashData.Notice
            - FlashData.Set
            - FlashData.Store
            - FlashData.Success
            - FlashData.Warning
            - Get
            - GetConfig
            - HTML2str
            - Handler
            - Head
            - Htmlquote
            - Htmlunquote
            - HttpServer.Any
            - HttpServer.AutoPrefix
            - HttpServer.AutoRouter
            - HttpServer.Delete
            - HttpServer.Get
            - HttpServer.Handler
            - HttpServer.Head
            - HttpServer.Include
            - HttpServer.InsertFilter
            - HttpServer.InsertFilterChain
            - HttpServer.LogAccess
            - HttpServer.Options
            - HttpServer.Patch
            - HttpServer.Post
            - HttpServer.PrintTree
            - HttpServer.Put
            - HttpServer.RESTRouter
            - HttpServer.Router
            - HttpServer.Run
            - Include
            - InitBeegoBeforeTest
            - InsertFilter
            - InsertFilterChain
            - LoadAppConfig
            - LogAccess
            - MapGet
            - Namespace.Any
            - Namespace.AutoPrefix
            - Namespace.AutoRouter
            - Namespace.Cond
            - Namespace.Delete
            - Namespace.Filter
            - Namespace.Get
            - Namespace.Handler
            - Namespace.Head
            - Namespace.Include
            - Namespace.Namespace
            - Namespace.Options
            - Namespace.Patch
            - Namespace.Post
            - Namespace.Put
            - Namespace.Router
            - NewControllerRegister
            - NewControllerRegisterWithCfg
            - NewHttpServerWithCfg
            - NewHttpSever
            - NewNamespace
            - NotNil
            - Options
            - ParseForm
            - Patch
            - Policy
            - Post
            - PrintTree
            - Put
            - RESTRouter
            - ReadFromRequest
            - RenderForm
            - Router
            - Run
            - RunWithMiddleWares
            - TestBeegoInit
            - Tree.AddRouter
            - Tree.AddTree
            - URLFor
            - URLMap.GetMap
            - URLMap.GetMapData
            - Walk
            - adminApp.Run
            - adminController.AdminIndex
            - adminController.Healthcheck
            - adminController.ListConf
            - adminController.ProfIndex
            - adminController.PrometheusMetrics
            - adminController.QpsIndex
            - adminController.TaskStatus
            - beegoAppConfig.Bool
            - beegoAppConfig.DefaultBool
            - beegoAppConfig.SaveConfigFile
            - beegoAppConfig.Unmarshaler
summary: |-
    Access control bypass via incorrect route lookup in github.com/beego/beego and
    beego/v2
description: |-
    An issue was discovered in the route lookup process in beego which attackers to
    bypass access control.
published: 2022-08-22T17:56:17Z
cves:
    - CVE-2021-30080
ghsas:
    - GHSA-28r6-jm5h-mrgg
references:
    - fix: https://github.com/beego/beego/pull/4459
    - fix: https://github.com/beego/beego/commit/d5df5e470d0a8ed291930ae802fd7e6b95226519
review_status: REVIEWED