GHSA-FGXV-GW55-R5FQ

Vulnerability from github – Published: 2024-03-04 20:42 – Updated: 2024-03-12 15:16
VLAI?
Summary
Authorization Bypass Through User-Controlled Key in go-zero
Details

Summary

Hello go-zero maintainer team, I would like to report a security concerning your CORS Filter feature.

Details

Go-zero allows user to specify a CORS Filter with a configurable allows param - which is an array of domains allowed in CORS policy.

However, the isOriginAllowed uses strings.HasSuffix to check the origin, which leads to bypass via domain like evil-victim.com

func isOriginAllowed(allows []string, origin string) bool {
    for _, o := range allows {
        if o == allOrigins {
            return true
        }

        if strings.HasSuffix(origin, o) {
            return true
        }
    }

    return false
}

PoC

Use code below as a PoC. Only requests from safe.com should bypass the CORS Filter

package main

import (
    "errors"
    "net/http"

    "github.com/zeromicro/go-zero/rest"
)

func main() {
    svr := rest.MustNewServer(rest.RestConf{Port: 8888}, rest.WithRouter(mockedRouter{}), rest.WithCors("safe.com"))
    svr.Start()
}

type mockedRouter struct{}

// some sensitive path
func (m mockedRouter) ServeHTTP(w http.ResponseWriter, r *http.Request) {
    // check user's cookie
    // ...
    // return sensitive data
    w.Write([]byte("social_id: 420101198008292930"))
}

func (m mockedRouter) Handle(_, _ string, handler http.Handler) error {
    return errors.New("foo")
}

func (m mockedRouter) SetNotFoundHandler(_ http.Handler) {
}

func (m mockedRouter) SetNotAllowedHandler(_ http.Handler) {
}

Send a request to localhost:8888 with Origin:not-safe.com You can see the origin reflected in response, which bypass the CORS Filter image

Impact

This vulnerability is capable of breaking CORS policy and thus allowing any page to make requests, retrieve data on behalf of other users.

Severity ?
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/zeromicro/go-zero"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-27302"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-03-04T20:42:33Z",
    "nvd_published_at": "2024-03-06T19:15:08Z",
    "severity": "CRITICAL"
  },
  "details": "### Summary\nHello go-zero maintainer team, I would like to report a security concerning your CORS Filter feature. \n\n### Details\nGo-zero allows user to specify a [CORS Filter](https://github.com/zeromicro/go-zero/blob/master/rest/internal/cors/handlers.go) with a configurable allows param - which is an array of domains allowed in CORS policy.\n\nHowever, the `isOriginAllowed` uses `strings.HasSuffix` to check the origin, which leads to bypass via domain like `evil-victim.com`\n```go\nfunc isOriginAllowed(allows []string, origin string) bool {\n\tfor _, o := range allows {\n\t\tif o == allOrigins {\n\t\t\treturn true\n\t\t}\n\n\t\tif strings.HasSuffix(origin, o) {\n\t\t\treturn true\n\t\t}\n\t}\n\n\treturn false\n}\n```\n\n### PoC\nUse code below as a PoC. Only requests from `safe.com` should bypass the CORS Filter\n```go\npackage main\n\nimport (\n\t\"errors\"\n\t\"net/http\"\n\n\t\"github.com/zeromicro/go-zero/rest\"\n)\n\nfunc main() {\n\tsvr := rest.MustNewServer(rest.RestConf{Port: 8888}, rest.WithRouter(mockedRouter{}), rest.WithCors(\"safe.com\"))\n\tsvr.Start()\n}\n\ntype mockedRouter struct{}\n\n// some sensitive path\nfunc (m mockedRouter) ServeHTTP(w http.ResponseWriter, r *http.Request) {\n\t// check user\u0027s cookie\n\t// ...\n\t// return sensitive data\n\tw.Write([]byte(\"social_id: 420101198008292930\"))\n}\n\nfunc (m mockedRouter) Handle(_, _ string, handler http.Handler) error {\n\treturn errors.New(\"foo\")\n}\n\nfunc (m mockedRouter) SetNotFoundHandler(_ http.Handler) {\n}\n\nfunc (m mockedRouter) SetNotAllowedHandler(_ http.Handler) {\n}\n```\nSend a request to localhost:8888 with `Origin:not-safe.com`\nYou can see the origin reflected in response, which bypass the CORS Filter\n![image](https://user-images.githubusercontent.com/70683161/221365842-9d76a3a4-a79d-413a-85b7-06b50b0a7807.png)\n\n### Impact\nThis vulnerability is capable of breaking CORS policy and thus allowing any page to make requests, retrieve data on behalf of other users.\n",
  "id": "GHSA-fgxv-gw55-r5fq",
  "modified": "2024-03-12T15:16:05Z",
  "published": "2024-03-04T20:42:33Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/zeromicro/go-zero/security/advisories/GHSA-fgxv-gw55-r5fq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27302"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zeromicro/go-zero/commit/d9d79e930dff6218a873f4f02115df61c38b15db"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/zeromicro/go-zero"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Authorization Bypass Through User-Controlled Key in go-zero"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.