Insecure CORS Configuration allowing wildcard origin with credentials in github.com/gofiber/fiber/v2
The CORS middleware allows for insecure configurations that could potentially expose the application to multiple CORS-related vulnerabilities. Specifically, it allows setting the Access-Control-Allow-Origin header to a wildcard ("*") while also having the Access-Control-Allow-Credentials set to true, which goes against recommended security best practices.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-25124US | critical9.8 | — | ||
Fiber is a web framework written in go. Prior to version 2.52.1, the CORS middleware allows for insecure configurations that could potentially expose the application to multiple CO… | ||||
02
references
External citations — patches, advisories, analysis.
- http://blog.portswigger.net/2016/10/exploiting-cors-misconfigurations-for.htmlWEB
- https://codeql.github.com/codeql-query-help/javascript/js-cors-misconfiguration-for-credentialsWEB
- https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS/Errors/CORSNotSupportingCredentialsWEB
- https://fetch.spec.whatwg.org/#cors-protocol-and-credentialsWEB
- https://github.com/gofiber/fiber/commit/f0cd3b44b086544a37886232d0530601f2406c23FIX
- https://github.com/gofiber/fiber/releases/tag/v2.52.1WEB
- https://github.com/gofiber/fiber/security/advisories/GHSA-fmg4-x8pw-hjhgADVISORY
- https://saturncloud.io/blog/cors-cannot-use-wildcard-in-accesscontrolalloworigin-when-credentials-flag-is-trueWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan