| id: GO-2022-0619 |
| modules: |
| - module: github.com/emicklei/go-restful |
| versions: |
| - fixed: 2.16.0+incompatible |
| vulnerable_at: 2.15.0+incompatible |
| packages: |
| - package: github.com/emicklei/go-restful |
| symbols: |
| - CrossOriginResourceSharing.isOriginAllowed |
| derived_symbols: |
| - CrossOriginResourceSharing.Filter |
| - module: github.com/emicklei/go-restful/v2 |
| versions: |
| - introduced: 2.7.1 |
| vulnerable_at: 2.7.1 |
| packages: |
| - package: github.com/emicklei/go-restful/v2 |
| symbols: |
| - CrossOriginResourceSharing.isOriginAllowed |
| derived_symbols: |
| - CrossOriginResourceSharing.Filter |
| - module: github.com/emicklei/go-restful/v3 |
| versions: |
| - introduced: 3.0.0 |
| - fixed: 3.8.0 |
| vulnerable_at: 3.7.4 |
| packages: |
| - package: github.com/emicklei/go-restful/v3 |
| symbols: |
| - CrossOriginResourceSharing.isOriginAllowed |
| derived_symbols: |
| - CrossOriginResourceSharing.Filter |
| summary: |- |
| Authorization bypass in github.com/emicklei/go-restful, go-restful/v2 and |
| go-restful/v3 |
| description: |- |
| CORS filters that use an AllowedDomains configuration parameter can match |
| domains outside the specified set, permitting an attacker to avoid the CORS |
| policy. |
| |
| The AllowedDomains configuration parameter is documented as a list of allowed |
| origin domains, but values in this list are applied as regular expression |
| matches. For example, an allowed domain of "example.com" will match the Origin |
| header "example.com.malicious.domain". |
| published: 2022-08-15T18:05:29Z |
| cves: |
| - CVE-2022-1996 |
| ghsas: |
| - GHSA-r48q-9g5r-8q2h |
| references: |
| - fix: https://github.com/emicklei/go-restful/commit/f292efff46ae17e9d104f865a60a39a2ae9402f1 |
| - web: https://github.com/emicklei/go-restful/issues/489 |
| review_status: REVIEWED |
