Overly permissive cross-domain whitelist in go-restful



Published: 2022-08-12
Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2022-1996
CWE-ID CWE-942
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe 		go-restful
Web applications / JS libraries

Vendor Ernest Micklei

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Overly permissive cross-domain whitelist

EUVDB-ID: #VU66447

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-1996

CWE-ID: CWE-942 - Overly Permissive Cross-domain Whitelist

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass the CORS protection mechanism.

The vulnerability exists due to incorrect processing of the "Origin" HTTP header that is supplied within HTTP request. A remote attacker can supply arbitrary value via the "Origin" HTTP header, bypass implemented CORS protection mechanism and perform cross-site scripting attacks against the vulnerable application.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

go-restful: 1.0.0 - 3.7.4

CPE2.3 External links

http://huntr.dev/bounties/be837427-415c-4d8c-808b-62ce20aa84f1
http://github.com/emicklei/go-restful/commit/fd3c327a379ce08c68ef18765bdc925f5d9bad10
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OBDD3Q23RCGAGHIXUCWBU6N3S4RNAKXB/
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/575BLJ3Y2EQBRNTFR2OSQQ6L2W6UCST3/
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR/
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5/

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###