CVE-2024-27302 - Vulnerability Details - OpenCVE

go-zero is a web and rpc framework. Go-zero allows user to specify a CORS Filter with a configurable allows param - which is an array of domains allowed in CORS policy. However, the `isOriginAllowed` uses `strings.HasSuffix` to check the origin, which leads to bypass via a malicious domain. This vulnerability is capable of breaking CORS policy and thus allowing any page to make requests and/or retrieve data on behalf of other users. Version 1.4.4 fixes this issue.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://github.com/zeromicro/go-zero/commit/d9d79e930dff6218a873f4f02115df61c38b15db
https://github.com/zeromicro/go-zero/security/advisories/GHSA-fgxv-gw55-r5fq

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2024-03-06T18:31:31.309Z

Updated: 2024-08-05T20:09:47.572Z

Reserved: 2024-02-22T18:08:38.875Z

Link: CVE-2024-27302

Vulnrichment

Updated: 2024-08-02T00:27:59.895Z

NVD

Status : Awaiting Analysis

Published: 2024-03-06T19:15:08.330

Modified: 2024-11-21T09:04:16.990

Link: CVE-2024-27302

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-27302", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-02-22T18:08:38.875Z", "datePublished": "2024-03-06T18:31:31.309Z", "dateUpdated": "2024-08-05T20:09:47.572Z"}, "containers": {"cna": {"title": "Authorization Bypass Through User-Controlled Key in go-zero", "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/zeromicro/go-zero/security/advisories/GHSA-fgxv-gw55-r5fq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/zeromicro/go-zero/security/advisories/GHSA-fgxv-gw55-r5fq"}, {"name": "https://github.com/zeromicro/go-zero/commit/d9d79e930dff6218a873f4f02115df61c38b15db", "tags": ["x_refsource_MISC"], "url": "https://github.com/zeromicro/go-zero/commit/d9d79e930dff6218a873f4f02115df61c38b15db"}], "affected": [{"vendor": "zeromicro", "product": "go-zero", "versions": [{"version": "< 1.4.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-03-06T18:31:31.309Z"}, "descriptions": [{"lang": "en", "value": "go-zero is a web and rpc framework. Go-zero allows user to specify a CORS Filter with a configurable allows param - which is an array of domains allowed in CORS policy. However, the `isOriginAllowed` uses `strings.HasSuffix` to check the origin, which leads to bypass via a malicious domain. This vulnerability is capable of breaking CORS policy and thus allowing any page to make requests and/or retrieve data on behalf of other users. Version 1.4.4 fixes this issue.\n"}], "source": {"advisory": "GHSA-fgxv-gw55-r5fq", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:27:59.895Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/zeromicro/go-zero/security/advisories/GHSA-fgxv-gw55-r5fq", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/zeromicro/go-zero/security/advisories/GHSA-fgxv-gw55-r5fq"}, {"name": "https://github.com/zeromicro/go-zero/commit/d9d79e930dff6218a873f4f02115df61c38b15db", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/zeromicro/go-zero/commit/d9d79e930dff6218a873f4f02115df61c38b15db"}]}, {"affected": [{"vendor": "zeromicro", "product": "go-zero", "cpes": ["cpe:2.3:a:zeromicro:go-zero:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "1.4.4", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-05T20:08:07.431796Z", "id": "CVE-2024-27302", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-05T20:09:47.572Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/zeromicro/go-zero/security/advisories/GHSA-fgxv-gw55-r5fq", "name": "https://github.com/zeromicro/go-zero/security/advisories/GHSA-fgxv-gw55-r5fq", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/zeromicro/go-zero/commit/d9d79e930dff6218a873f4f02115df61c38b15db", "name": "https://github.com/zeromicro/go-zero/commit/d9d79e930dff6218a873f4f02115df61c38b15db", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:27:59.895Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-27302", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-08-05T20:08:07.431796Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:zeromicro:go-zero:*:*:*:*:*:*:*:*"], "vendor": "zeromicro", "product": "go-zero", "versions": [{"status": "affected", "version": "0", "lessThan": "1.4.4", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-05T20:09:40.931Z"}}], "cna": {"title": "Authorization Bypass Through User-Controlled Key in go-zero", "source": {"advisory": "GHSA-fgxv-gw55-r5fq", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "zeromicro", "product": "go-zero", "versions": [{"status": "affected", "version": "< 1.4.4"}]}], "references": [{"url": "https://github.com/zeromicro/go-zero/security/advisories/GHSA-fgxv-gw55-r5fq", "name": "https://github.com/zeromicro/go-zero/security/advisories/GHSA-fgxv-gw55-r5fq", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/zeromicro/go-zero/commit/d9d79e930dff6218a873f4f02115df61c38b15db", "name": "https://github.com/zeromicro/go-zero/commit/d9d79e930dff6218a873f4f02115df61c38b15db", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "go-zero is a web and rpc framework. Go-zero allows user to specify a CORS Filter with a configurable allows param - which is an array of domains allowed in CORS policy. However, the `isOriginAllowed` uses `strings.HasSuffix` to check the origin, which leads to bypass via a malicious domain. This vulnerability is capable of breaking CORS policy and thus allowing any page to make requests and/or retrieve data on behalf of other users. Version 1.4.4 fixes this issue.\n"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-03-06T18:31:31.309Z"}}}, "cveMetadata": {"cveId": "CVE-2024-27302", "state": "PUBLISHED", "dateUpdated": "2024-08-05T20:09:47.572Z", "dateReserved": "2024-02-22T18:08:38.875Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-03-06T18:31:31.309Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"descriptions": [{"lang": "en", "value": "go-zero is a web and rpc framework. Go-zero allows user to specify a CORS Filter with a configurable allows param - which is an array of domains allowed in CORS policy. However, the `isOriginAllowed` uses `strings.HasSuffix` to check the origin, which leads to bypass via a malicious domain. This vulnerability is capable of breaking CORS policy and thus allowing any page to make requests and/or retrieve data on behalf of other users. Version 1.4.4 fixes this issue.\n"}, {"lang": "es", "value": "go-zero es un framework web y rpc. Go-zero permite al usuario especificar un filtro CORS con un par\u00e1metro de permisos configurable, que es una serie de dominios permitidos en la pol\u00edtica CORS. Sin embargo, `isOriginAllowed` usa `strings.HasSuffix` para verificar el origen, lo que lleva a pasar por alto un dominio malicioso. Esta vulnerabilidad es capaz de romper la pol\u00edtica CORS y as\u00ed permitir que cualquier p\u00e1gina realice solicitudes y/o recupere datos en nombre de otros usuarios. La versi\u00f3n 1.4.4 soluciona este problema."}], "id": "CVE-2024-27302", "lastModified": "2024-11-21T09:04:16.990", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2024-03-06T19:15:08.330", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/zeromicro/go-zero/commit/d9d79e930dff6218a873f4f02115df61c38b15db"}, {"source": "security-advisories@github.com", "url": "https://github.com/zeromicro/go-zero/security/advisories/GHSA-fgxv-gw55-r5fq"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/zeromicro/go-zero/commit/d9d79e930dff6218a873f4f02115df61c38b15db"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/zeromicro/go-zero/security/advisories/GHSA-fgxv-gw55-r5fq"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security-advisories@github.com", "type": "Secondary"}]}