Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/gorilla/csrf

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.4GoPublished

    gorilla/csrf CSRF vulnerability due to broken Referer validation

    CVE-2025-24358 · GHSA-rq77-p4h8-4crw

    Affected
    • Go github.com/gorilla/csrf < 1.7.3
    Fixed in
    1.7.3· Vendor fix available
    Issue
    gorilla/csrf is vulnerable to CSRF via form submission from origins that share a top level domain with the target origin. Details gorilla/csrf does not validate the Origin header against an allowlist. Its executes its validation of the Referer header for cross-origin requests only when it believes the request is being served over TLS. It determines this by inspecting the r.URL.Scheme value. However, this value is never populated for "server" requests per the Go spec, and so this check does not run in practice. PoC - create trusted origin target.example.test protected with gorilla/csrf and served over TLS hosting form on /submit - create attacker origin attack.example.test served over TLS - attacker exfiltrates token & cookie combination from target.example.test - attacker sets exfiltrated cookie with domain=.example.test and path=/submit - as the cookie has a more specific path than / (the default for CSRF cookies) it will be sent first by the browser on submit to our target…

    Recommended action: Upgrade to 1.7.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →