CVE-2018-20744: github.com/gofiber/fiber/v2 vulnerable to Origin Validation Error
(updated )
The Olivier Poitrey Go CORS handler through 1.3.0 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible with the CORS security design, and could lead to CORS misconfiguration security problems.
References
- github.com/advisories/GHSA-927h-x4qj-r242
- github.com/gofiber/fiber
- github.com/gofiber/fiber/issues/2338
- github.com/gofiber/fiber/pull/2339
- github.com/rs/cors/issues/55
- github.com/rs/cors/pull/57
- nvd.nist.gov/vuln/detail/CVE-2018-20744
- web.archive.org/web/20200227091122/http://www.securityfocus.com/bid/106834
- www.usenix.org/system/files/conference/usenixsecurity18/sec18-chen.pdf
Detect and mitigate CVE-2018-20744 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →