CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-38513 – Fiber Session Middleware Token Injection Vulnerability
https://notcve.org/view.php?id=CVE-2024-38513
Fiber is an Express-inspired web framework written in Go A vulnerability present in versions prior to 2.52.5 is a session middleware issue in GoFiber versions 2 and above. This vulnerability allows users to supply their own session_id value, resulting in the creation of a session with that key. If a website relies on the mere presence of a session for security purposes, this can lead to significant security risks, including unauthorized access and session fixation attacks. All users utilizing GoFiber's session middleware in the affected versions are impacted. The issue has been addressed in version 2.52.5. • https://github.com/gofiber/fiber/commit/66a881441b27322a331f1b526cf1eb6b3358a4d8 https://github.com/gofiber/fiber/security/advisories/GHSA-98j2-3j3p-fw2v • CWE-384: Session Fixation •
CVSS: 9.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-25124 – Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials
https://notcve.org/view.php?id=CVE-2024-25124
Fiber is a web framework written in go. Prior to version 2.52.1, the CORS middleware allows for insecure configurations that could potentially expose the application to multiple CORS-related vulnerabilities. Specifically, it allows setting the Access-Control-Allow-Origin header to a wildcard (`*`) while also having the Access-Control-Allow-Credentials set to true, which goes against recommended security best practices. The impact of this misconfiguration is high as it can lead to unauthorized access to sensitive user data and expose the system to various types of attacks listed in the PortSwigger article linked in the references. Version 2.52.1 contains a patch for this issue. • http://blog.portswigger.net/2016/10/exploiting-cors-misconfigurations-for.html https://codeql.github.com/codeql-query-help/javascript/js-cors-misconfiguration-for-credentials https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS/Errors/CORSNotSupportingCredentials https://fetch.spec.whatwg.org/#cors-protocol-and-credentials https://github.com/gofiber/fiber/commit/f0cd3b44b086544a37886232d0530601f2406c23 https://github.com/gofiber/fiber/releases/tag/v2.52.1 https://github.com/gofiber/fiber/security/advisories/GHSA • CWE-346: Origin Validation Error CWE-942: Permissive Cross-domain Policy with Untrusted Domains •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-45141 – CSRF Token Validation Vulnerability in fiber
https://notcve.org/view.php?id=CVE-2023-45141
Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allows an attacker to obtain tokens and forge malicious requests on behalf of a user. This can lead to unauthorized actions being taken on the user's behalf, potentially compromising the security and integrity of the application. The vulnerability is caused by improper validation and enforcement of CSRF tokens within the application. This vulnerability has been addressed in version 2.50.0 and users are advised to upgrade. • https://github.com/gofiber/fiber/security/advisories/GHSA-mv73-f69x-444p • CWE-352: Cross-Site Request Forgery (CSRF) CWE-565: Reliance on Cookies without Validation and Integrity Checking •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-45128 – CSRF Token Reuse Vulnerability in fiber
https://notcve.org/view.php?id=CVE-2023-45128
Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allows an attacker to inject arbitrary values and forge malicious requests on behalf of a user. This vulnerability can allow an attacker to inject arbitrary values without any authentication, or perform various malicious actions on behalf of an authenticated user, potentially compromising the security and integrity of the application. The vulnerability is caused by improper validation and enforcement of CSRF tokens within the application. This issue has been addressed in version 2.50.0 and users are advised to upgrade. • https://github.com/gofiber/fiber/commit/8c3916dbf4ad2ed427d02c6eb63ae8b2fa8f019a https://github.com/gofiber/fiber/security/advisories/GHSA-94w9-97p3-p368 • CWE-20: Improper Input Validation CWE-352: Cross-Site Request Forgery (CSRF) CWE-565: Reliance on Cookies without Validation and Integrity Checking CWE-807: Reliance on Untrusted Inputs in a Security Decision •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-41338 – Vulnerability in Ctx.IsFromLocal() in gofiber
https://notcve.org/view.php?id=CVE-2023-41338
Fiber is an Express inspired web framework built in the go language. Versions of gofiber prior to 2.49.2 did not properly restrict access to localhost. This issue impacts users of our project who rely on the `ctx.IsFromLocal` method to restrict access to localhost requests. If exploited, it could allow unauthorized access to resources intended only for localhost. Setting `X-Forwarded-For: 127.0.0.1` in a request from a foreign host, will result in true for `ctx.IsFromLocal`. • https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For https://docs.gofiber.io/api/ctx#isfromlocal https://github.com/gofiber/fiber/commit/b8c9ede6efa231116c4bd8bb9d5e03eac1cb76dc https://github.com/gofiber/fiber/security/advisories/GHSA-3q5p-3558-364f • CWE-670: Always-Incorrect Control Flow Implementation •