Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/zeromicro/go-zero

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.1GoPublished

    Authorization Bypass Through User-Controlled Key in go-zero

    CVE-2024-27302 · GHSA-fgxv-gw55-r5fq

    Affected
    • Go github.com/zeromicro/go-zero < 1.4.4
    Fixed in
    1.4.4· Vendor fix available
    Issue
    Hello go-zero maintainer team, I would like to report a security concerning your CORS Filter feature. Details Go-zero allows user to specify a CORS Filter with a configurable allows param - which is an array of domains allowed in CORS policy. However, the isOriginAllowed uses strings.HasSuffix to check the origin, which leads to bypass via domain like evil-victim.com PoC Use code below as a PoC. Only requests from safe.com should bypass the CORS Filter Send a request to localhost:8888 with Origin:not-safe.com You can see the origin reflected in response, which bypass the CORS Filter Impact This vulnerability is capable of breaking CORS policy and thus allowing any page to make requests, retrieve data on behalf of other users.

    Recommended action: Upgrade to 1.4.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →