CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-41338 – Vulnerability in Ctx.IsFromLocal() in gofiber
https://notcve.org/view.php?id=CVE-2023-41338
Fiber is an Express inspired web framework built in the go language. Versions of gofiber prior to 2.49.2 did not properly restrict access to localhost. This issue impacts users of our project who rely on the `ctx.IsFromLocal` method to restrict access to localhost requests. If exploited, it could allow unauthorized access to resources intended only for localhost. Setting `X-Forwarded-For: 127.0.0.1` in a request from a foreign host, will result in true for `ctx.IsFromLocal`. • https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For https://docs.gofiber.io/api/ctx#isfromlocal https://github.com/gofiber/fiber/commit/b8c9ede6efa231116c4bd8bb9d5e03eac1cb76dc https://github.com/gofiber/fiber/security/advisories/GHSA-3q5p-3558-364f • CWE-670: Always-Incorrect Control Flow Implementation •
CVSS: 5.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15111 – CRLF vulnerability in Fiber
https://notcve.org/view.php?id=CVE-2020-15111
In Fiber before version 1.12.6, the filename that is given in c.Attachment() (https://docs.gofiber.io/ctx#attachment) is not escaped, and therefore vulnerable for a CRLF injection attack. I.e. an attacker could upload a custom filename and then give the link to the victim. With this filename, the attacker can change the name of the downloaded file, redirect to another site, change the authorization header, etc. A possible workaround is to serialize the input before passing it to ctx.Attachment(). En Fiber versiones anteriores a 1.12.6, el nombre de archivo que se proporciona en la función c.Attachment() (https://docs.gofiber.io/ctx#attachment) no es escapado y, por lo tanto, es vulnerable a un ataque de inyección CRLF. • https://github.com/gofiber/fiber/pull/579/commits/f698b5d5066cfe594102ae252cd58a1fe57cf56f https://github.com/gofiber/fiber/security/advisories/GHSA-9cx9-x2gp-9qvh • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection') •