by Kastro
Paper/Archive/CVE-2024-27302

CVE-2024-27302

zeromicro go-zero — Authorization Bypass Through User-Controlled Key in go-zero

EPSS 0.8%public exploitCVSS 9.1
critical.is priorityof 100
49
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 55.8.558 × 2011.2Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

go-zero is a web and rpc framework. Go-zero allows user to specify a CORS Filter with a configurable allows param - which is an array of domains allowed in CORS policy. However, the `isOriginAllowed` uses `strings.HasSuffix` to check the origin, which leads to bypass via a malicious domain. This vulnerability is capable of breaking CORS policy and thus allowing any page to make requests and/or retrieve data on behalf of other users. Version 1.4.4 fixes this issue.

Affected

ProductAffectedFixed inSource
go-zero< 1.4.4–CNA
go-zero< 1.4.41.4.4CISA-ADP

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refgithub.com/zeromicro/go-zero/security/advisories/GHSA-fgxv-gw55-r5fqrefgithub.com/zeromicro/go-zero/commit/d9d79e930dff6218a873f4f02115df61c38b15db