CVE-2024-27302 (GCVE-0-2024-27302)
Vulnerability from cvelistv5 – Published: 2024-03-06 18:31 – Updated: 2024-08-05 20:09
VLAI
EPSS
VEX
Title
Authorization Bypass Through User-Controlled Key in go-zero
Summary
go-zero is a web and rpc framework. Go-zero allows user to specify a CORS Filter with a configurable allows param - which is an array of domains allowed in CORS policy. However, the `isOriginAllowed` uses `strings.HasSuffix` to check the origin, which leads to bypass via a malicious domain. This vulnerability is capable of breaking CORS policy and thus allowing any page to make requests and/or retrieve data on behalf of other users. Version 1.4.4 fixes this issue.
Severity
9.1 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-05 20:08 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/zeromicro/go-zero/security/adv… | x_refsource_CONFIRM |
| https://github.com/zeromicro/go-zero/commit/d9d79… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:27:59.895Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/zeromicro/go-zero/security/advisories/GHSA-fgxv-gw55-r5fq",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/zeromicro/go-zero/security/advisories/GHSA-fgxv-gw55-r5fq"
},
{
"name": "https://github.com/zeromicro/go-zero/commit/d9d79e930dff6218a873f4f02115df61c38b15db",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/zeromicro/go-zero/commit/d9d79e930dff6218a873f4f02115df61c38b15db"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:zeromicro:go-zero:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "go-zero",
"vendor": "zeromicro",
"versions": [
{
"lessThan": "1.4.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-27302",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-05T20:08:07.431796Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-05T20:09:47.572Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "go-zero",
"vendor": "zeromicro",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "go-zero is a web and rpc framework. Go-zero allows user to specify a CORS Filter with a configurable allows param - which is an array of domains allowed in CORS policy. However, the `isOriginAllowed` uses `strings.HasSuffix` to check the origin, which leads to bypass via a malicious domain. This vulnerability is capable of breaking CORS policy and thus allowing any page to make requests and/or retrieve data on behalf of other users. Version 1.4.4 fixes this issue.\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-06T18:31:31.309Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/zeromicro/go-zero/security/advisories/GHSA-fgxv-gw55-r5fq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/zeromicro/go-zero/security/advisories/GHSA-fgxv-gw55-r5fq"
},
{
"name": "https://github.com/zeromicro/go-zero/commit/d9d79e930dff6218a873f4f02115df61c38b15db",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zeromicro/go-zero/commit/d9d79e930dff6218a873f4f02115df61c38b15db"
}
],
"source": {
"advisory": "GHSA-fgxv-gw55-r5fq",
"discovery": "UNKNOWN"
},
"title": "Authorization Bypass Through User-Controlled Key in go-zero"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-27302",
"datePublished": "2024-03-06T18:31:31.309Z",
"dateReserved": "2024-02-22T18:08:38.875Z",
"dateUpdated": "2024-08-05T20:09:47.572Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2024-27302",
"date": "2026-10-01",
"epss": "0.00774",
"percentile": "0.5412"
},
"fkie_nvd": {
"descriptions": [
{
"lang": "en",
"value": "go-zero is a web and rpc framework. Go-zero allows user to specify a CORS Filter with a configurable allows param - which is an array of domains allowed in CORS policy. However, the `isOriginAllowed` uses `strings.HasSuffix` to check the origin, which leads to bypass via a malicious domain. This vulnerability is capable of breaking CORS policy and thus allowing any page to make requests and/or retrieve data on behalf of other users. Version 1.4.4 fixes this issue.\n"
},
{
"lang": "es",
"value": "go-zero es un framework web y rpc. Go-zero permite al usuario especificar un filtro CORS con un par\u00e1metro de permisos configurable, que es una serie de dominios permitidos en la pol\u00edtica CORS. Sin embargo, `isOriginAllowed` usa `strings.HasSuffix` para verificar el origen, lo que lleva a pasar por alto un dominio malicioso. Esta vulnerabilidad es capaz de romper la pol\u00edtica CORS y as\u00ed permitir que cualquier p\u00e1gina realice solicitudes y/o recupere datos en nombre de otros usuarios. La versi\u00f3n 1.4.4 soluciona este problema."
}
],
"id": "CVE-2024-27302",
"lastModified": "2024-11-21T09:04:16.990",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.2,
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
},
"published": "2024-03-06T19:15:08.330",
"references": [
{
"source": "security-advisories@github.com",
"url": "https://github.com/zeromicro/go-zero/commit/d9d79e930dff6218a873f4f02115df61c38b15db"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/zeromicro/go-zero/security/advisories/GHSA-fgxv-gw55-r5fq"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://github.com/zeromicro/go-zero/commit/d9d79e930dff6218a873f4f02115df61c38b15db"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://github.com/zeromicro/go-zero/security/advisories/GHSA-fgxv-gw55-r5fq"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-639"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"product": "go-zero",
"vendor": "zeromicro",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.4"
}
]
}
],
"source": "security-advisories@github.com"
},
{
"affectedData": [
{
"cpes": [
"cpe:2.3:a:zeromicro:go-zero:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "go-zero",
"vendor": "zeromicro",
"versions": [
{
"lessThan": "1.4.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:go-zero:go-zero:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DA8631C0-17CF-4C5F-B40D-079902220441",
"versionEndExcluding": "1.4.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "go-zero is a web and rpc framework. Go-zero allows user to specify a CORS Filter with a configurable allows param - which is an array of domains allowed in CORS policy. However, the `isOriginAllowed` uses `strings.HasSuffix` to check the origin, which leads to bypass via a malicious domain. This vulnerability is capable of breaking CORS policy and thus allowing any page to make requests and/or retrieve data on behalf of other users. Version 1.4.4 fixes this issue.\n"
},
{
"lang": "es",
"value": "go-zero es un framework web y rpc. Go-zero permite al usuario especificar un filtro CORS con un par\u00e1metro de permisos configurable, que es una serie de dominios permitidos en la pol\u00edtica CORS. Sin embargo, `isOriginAllowed` usa `strings.HasSuffix` para verificar el origen, lo que lleva a pasar por alto un dominio malicioso. Esta vulnerabilidad es capaz de romper la pol\u00edtica CORS y as\u00ed permitir que cualquier p\u00e1gina realice solicitudes y/o recupere datos en nombre de otros usuarios. La versi\u00f3n 1.4.4 soluciona este problema."
}
],
"id": "CVE-2024-27302",
"lastModified": "2026-06-17T07:19:36.433",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.2,
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2024-27302",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-05T20:08:07.431796Z",
"version": "2.0.3"
}
}
]
},
"published": "2024-03-06T19:15:08.330",
"references": [
{
"source": "security-advisories@github.com",
"tags": [
"Patch"
],
"url": "https://github.com/zeromicro/go-zero/commit/d9d79e930dff6218a873f4f02115df61c38b15db"
},
{
"source": "security-advisories@github.com",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://github.com/zeromicro/go-zero/security/advisories/GHSA-fgxv-gw55-r5fq"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/zeromicro/go-zero/commit/d9d79e930dff6218a873f4f02115df61c38b15db"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://github.com/zeromicro/go-zero/security/advisories/GHSA-fgxv-gw55-r5fq"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-639"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
},
"redhat_vex": {
"current_release_date": "2025-05-28T22:11:19+00:00",
"cve": "CVE-2024-27302",
"id": "CVE-2024-27302",
"initial_release_date": "2024-01-01T00:00:00+00:00",
"product_status:known_not_affected": "1",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "Authorization Bypass Through User-Controlled Key in go-zero",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-27302.json",
"version": "3"
},
"vulnrichment": {
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:27:59.895Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/zeromicro/go-zero/security/advisories/GHSA-fgxv-gw55-r5fq",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/zeromicro/go-zero/security/advisories/GHSA-fgxv-gw55-r5fq"
},
{
"name": "https://github.com/zeromicro/go-zero/commit/d9d79e930dff6218a873f4f02115df61c38b15db",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/zeromicro/go-zero/commit/d9d79e930dff6218a873f4f02115df61c38b15db"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:zeromicro:go-zero:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "go-zero",
"vendor": "zeromicro",
"versions": [
{
"lessThan": "1.4.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-27302",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-05T20:08:07.431796Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-05T20:09:40.931Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "go-zero",
"vendor": "zeromicro",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "go-zero is a web and rpc framework. Go-zero allows user to specify a CORS Filter with a configurable allows param - which is an array of domains allowed in CORS policy. However, the `isOriginAllowed` uses `strings.HasSuffix` to check the origin, which leads to bypass via a malicious domain. This vulnerability is capable of breaking CORS policy and thus allowing any page to make requests and/or retrieve data on behalf of other users. Version 1.4.4 fixes this issue.\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-06T18:31:31.309Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/zeromicro/go-zero/security/advisories/GHSA-fgxv-gw55-r5fq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/zeromicro/go-zero/security/advisories/GHSA-fgxv-gw55-r5fq"
},
{
"name": "https://github.com/zeromicro/go-zero/commit/d9d79e930dff6218a873f4f02115df61c38b15db",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zeromicro/go-zero/commit/d9d79e930dff6218a873f4f02115df61c38b15db"
}
],
"source": {
"advisory": "GHSA-fgxv-gw55-r5fq",
"discovery": "UNKNOWN"
},
"title": "Authorization Bypass Through User-Controlled Key in go-zero"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-27302",
"datePublished": "2024-03-06T18:31:31.309Z",
"dateReserved": "2024-02-22T18:08:38.875Z",
"dateUpdated": "2024-08-05T20:09:47.572Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
FKIE_CVE-2024-27302
Vulnerability from fkie_nvd - Published: 2024-03-06 19:15 - Updated: 2026-06-17 07:19
Severity
Summary
go-zero is a web and rpc framework. Go-zero allows user to specify a CORS Filter with a configurable allows param - which is an array of domains allowed in CORS policy. However, the `isOriginAllowed` uses `strings.HasSuffix` to check the origin, which leads to bypass via a malicious domain. This vulnerability is capable of breaking CORS policy and thus allowing any page to make requests and/or retrieve data on behalf of other users. Version 1.4.4 fixes this issue.
References
{
"affected": [
{
"affectedData": [
{
"product": "go-zero",
"vendor": "zeromicro",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.4"
}
]
}
],
"source": "security-advisories@github.com"
},
{
"affectedData": [
{
"cpes": [
"cpe:2.3:a:zeromicro:go-zero:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "go-zero",
"vendor": "zeromicro",
"versions": [
{
"lessThan": "1.4.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:go-zero:go-zero:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DA8631C0-17CF-4C5F-B40D-079902220441",
"versionEndExcluding": "1.4.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "go-zero is a web and rpc framework. Go-zero allows user to specify a CORS Filter with a configurable allows param - which is an array of domains allowed in CORS policy. However, the `isOriginAllowed` uses `strings.HasSuffix` to check the origin, which leads to bypass via a malicious domain. This vulnerability is capable of breaking CORS policy and thus allowing any page to make requests and/or retrieve data on behalf of other users. Version 1.4.4 fixes this issue.\n"
},
{
"lang": "es",
"value": "go-zero es un framework web y rpc. Go-zero permite al usuario especificar un filtro CORS con un par\u00e1metro de permisos configurable, que es una serie de dominios permitidos en la pol\u00edtica CORS. Sin embargo, `isOriginAllowed` usa `strings.HasSuffix` para verificar el origen, lo que lleva a pasar por alto un dominio malicioso. Esta vulnerabilidad es capaz de romper la pol\u00edtica CORS y as\u00ed permitir que cualquier p\u00e1gina realice solicitudes y/o recupere datos en nombre de otros usuarios. La versi\u00f3n 1.4.4 soluciona este problema."
}
],
"id": "CVE-2024-27302",
"lastModified": "2026-06-17T07:19:36.433",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.2,
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2024-27302",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-05T20:08:07.431796Z",
"version": "2.0.3"
}
}
]
},
"published": "2024-03-06T19:15:08.330",
"references": [
{
"source": "security-advisories@github.com",
"tags": [
"Patch"
],
"url": "https://github.com/zeromicro/go-zero/commit/d9d79e930dff6218a873f4f02115df61c38b15db"
},
{
"source": "security-advisories@github.com",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://github.com/zeromicro/go-zero/security/advisories/GHSA-fgxv-gw55-r5fq"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/zeromicro/go-zero/commit/d9d79e930dff6218a873f4f02115df61c38b15db"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://github.com/zeromicro/go-zero/security/advisories/GHSA-fgxv-gw55-r5fq"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-639"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
GHSA-FGXV-GW55-R5FQ
Vulnerability from github – Published: 2024-03-04 20:42 – Updated: 2024-03-12 15:16
VLAI
Summary
Authorization Bypass Through User-Controlled Key in go-zero
Details
Summary
Hello go-zero maintainer team, I would like to report a security concerning your CORS Filter feature.
Details
Go-zero allows user to specify a CORS Filter with a configurable allows param - which is an array of domains allowed in CORS policy.
However, the isOriginAllowed uses strings.HasSuffix to check the origin, which leads to bypass via domain like evil-victim.com
func isOriginAllowed(allows []string, origin string) bool {
for _, o := range allows {
if o == allOrigins {
return true
}
if strings.HasSuffix(origin, o) {
return true
}
}
return false
}
PoC
Use code below as a PoC. Only requests from safe.com should bypass the CORS Filter
package main
import (
"errors"
"net/http"
"github.com/zeromicro/go-zero/rest"
)
func main() {
svr := rest.MustNewServer(rest.RestConf{Port: 8888}, rest.WithRouter(mockedRouter{}), rest.WithCors("safe.com"))
svr.Start()
}
type mockedRouter struct{}
// some sensitive path
func (m mockedRouter) ServeHTTP(w http.ResponseWriter, r *http.Request) {
// check user's cookie
// ...
// return sensitive data
w.Write([]byte("social_id: 420101198008292930"))
}
func (m mockedRouter) Handle(_, _ string, handler http.Handler) error {
return errors.New("foo")
}
func (m mockedRouter) SetNotFoundHandler(_ http.Handler) {
}
func (m mockedRouter) SetNotAllowedHandler(_ http.Handler) {
}
Send a request to localhost:8888 with Origin:not-safe.com
You can see the origin reflected in response, which bypass the CORS Filter
Impact
This vulnerability is capable of breaking CORS policy and thus allowing any page to make requests, retrieve data on behalf of other users.
Severity
9.1 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/zeromicro/go-zero"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-27302"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2024-03-04T20:42:33Z",
"nvd_published_at": "2024-03-06T19:15:08Z",
"severity": "CRITICAL"
},
"details": "### Summary\nHello go-zero maintainer team, I would like to report a security concerning your CORS Filter feature. \n\n### Details\nGo-zero allows user to specify a [CORS Filter](https://github.com/zeromicro/go-zero/blob/master/rest/internal/cors/handlers.go) with a configurable allows param - which is an array of domains allowed in CORS policy.\n\nHowever, the `isOriginAllowed` uses `strings.HasSuffix` to check the origin, which leads to bypass via domain like `evil-victim.com`\n```go\nfunc isOriginAllowed(allows []string, origin string) bool {\n\tfor _, o := range allows {\n\t\tif o == allOrigins {\n\t\t\treturn true\n\t\t}\n\n\t\tif strings.HasSuffix(origin, o) {\n\t\t\treturn true\n\t\t}\n\t}\n\n\treturn false\n}\n```\n\n### PoC\nUse code below as a PoC. Only requests from `safe.com` should bypass the CORS Filter\n```go\npackage main\n\nimport (\n\t\"errors\"\n\t\"net/http\"\n\n\t\"github.com/zeromicro/go-zero/rest\"\n)\n\nfunc main() {\n\tsvr := rest.MustNewServer(rest.RestConf{Port: 8888}, rest.WithRouter(mockedRouter{}), rest.WithCors(\"safe.com\"))\n\tsvr.Start()\n}\n\ntype mockedRouter struct{}\n\n// some sensitive path\nfunc (m mockedRouter) ServeHTTP(w http.ResponseWriter, r *http.Request) {\n\t// check user\u0027s cookie\n\t// ...\n\t// return sensitive data\n\tw.Write([]byte(\"social_id: 420101198008292930\"))\n}\n\nfunc (m mockedRouter) Handle(_, _ string, handler http.Handler) error {\n\treturn errors.New(\"foo\")\n}\n\nfunc (m mockedRouter) SetNotFoundHandler(_ http.Handler) {\n}\n\nfunc (m mockedRouter) SetNotAllowedHandler(_ http.Handler) {\n}\n```\nSend a request to localhost:8888 with `Origin:not-safe.com`\nYou can see the origin reflected in response, which bypass the CORS Filter\n\n\n### Impact\nThis vulnerability is capable of breaking CORS policy and thus allowing any page to make requests, retrieve data on behalf of other users.\n",
"id": "GHSA-fgxv-gw55-r5fq",
"modified": "2024-03-12T15:16:05Z",
"published": "2024-03-04T20:42:33Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/zeromicro/go-zero/security/advisories/GHSA-fgxv-gw55-r5fq"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27302"
},
{
"type": "WEB",
"url": "https://github.com/zeromicro/go-zero/commit/d9d79e930dff6218a873f4f02115df61c38b15db"
},
{
"type": "PACKAGE",
"url": "https://github.com/zeromicro/go-zero"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Authorization Bypass Through User-Controlled Key in go-zero"
}
GSD-2024-27302
Vulnerability from gsd - Updated: 2024-02-23 06:03Details
go-zero is a web and rpc framework. Go-zero allows user to specify a CORS Filter with a configurable allows param - which is an array of domains allowed in CORS policy. However, the `isOriginAllowed` uses `strings.HasSuffix` to check the origin, which leads to bypass via a malicious domain. This vulnerability is capable of breaking CORS policy and thus allowing any page to make requests and/or retrieve data on behalf of other users. Version 1.4.4 fixes this issue.
Aliases
{
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2024-27302"
],
"details": "go-zero is a web and rpc framework. Go-zero allows user to specify a CORS Filter with a configurable allows param - which is an array of domains allowed in CORS policy. However, the `isOriginAllowed` uses `strings.HasSuffix` to check the origin, which leads to bypass via a malicious domain. This vulnerability is capable of breaking CORS policy and thus allowing any page to make requests and/or retrieve data on behalf of other users. Version 1.4.4 fixes this issue.\n",
"id": "GSD-2024-27302",
"modified": "2024-02-23T06:03:43.495921Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2024-27302",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "go-zero",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "\u003c 1.4.4"
}
]
}
}
]
},
"vendor_name": "zeromicro"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "go-zero is a web and rpc framework. Go-zero allows user to specify a CORS Filter with a configurable allows param - which is an array of domains allowed in CORS policy. However, the `isOriginAllowed` uses `strings.HasSuffix` to check the origin, which leads to bypass via a malicious domain. This vulnerability is capable of breaking CORS policy and thus allowing any page to make requests and/or retrieve data on behalf of other users. Version 1.4.4 fixes this issue.\n"
}
]
},
"impact": {
"cvss": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"cweId": "CWE-639",
"lang": "eng",
"value": "CWE-639: Authorization Bypass Through User-Controlled Key"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/zeromicro/go-zero/security/advisories/GHSA-fgxv-gw55-r5fq",
"refsource": "MISC",
"url": "https://github.com/zeromicro/go-zero/security/advisories/GHSA-fgxv-gw55-r5fq"
},
{
"name": "https://github.com/zeromicro/go-zero/commit/d9d79e930dff6218a873f4f02115df61c38b15db",
"refsource": "MISC",
"url": "https://github.com/zeromicro/go-zero/commit/d9d79e930dff6218a873f4f02115df61c38b15db"
}
]
},
"source": {
"advisory": "GHSA-fgxv-gw55-r5fq",
"discovery": "UNKNOWN"
}
},
"nvd.nist.gov": {
"cve": {
"descriptions": [
{
"lang": "en",
"value": "go-zero is a web and rpc framework. Go-zero allows user to specify a CORS Filter with a configurable allows param - which is an array of domains allowed in CORS policy. However, the `isOriginAllowed` uses `strings.HasSuffix` to check the origin, which leads to bypass via a malicious domain. This vulnerability is capable of breaking CORS policy and thus allowing any page to make requests and/or retrieve data on behalf of other users. Version 1.4.4 fixes this issue.\n"
}
],
"id": "CVE-2024-27302",
"lastModified": "2024-03-06T21:42:48.053",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.2,
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
},
"published": "2024-03-06T19:15:08.330",
"references": [
{
"source": "security-advisories@github.com",
"url": "https://github.com/zeromicro/go-zero/commit/d9d79e930dff6218a873f4f02115df61c38b15db"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/zeromicro/go-zero/security/advisories/GHSA-fgxv-gw55-r5fq"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-639"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…