CVE-2024-27302

go-zero is a web and rpc framework. Go-zero allows user to specify a CORS Filter with a configurable allows param - which is an array of domains allowed in CORS policy. However, the isOriginAllowed uses strings.HasSuffix to check the origin, which leads to bypass via a malicious domain. This vulnerability is capable of breaking CORS policy and thus allowing any page to make requests and/or retrieve data on behalf of other users. Version 1.4.4 fixes this issue.

go-zero is a web and rpc framework. Go-zero allows user to specify a CORS Filter with a configurable allows param - which is an array of domains allowed in CORS policy. However, the isOriginAllowed uses strings.HasSuffix to check the origin, which leads to bypass via a malicious domain. This vulnerability is capable of breaking CORS policy and thus allowing any page to make requests and/or retrieve data on behalf of other users. Version 1.4.4 fixes this issue.

Summary

Hello go-zero maintainer team, I would like to report a security concerning your CORS Filter feature.

Details

Go-zero allows user to specify a CORS Filter with a configurable allows param - which is an array of domains allowed in CORS policy.

However, the isOriginAllowed uses strings.HasSuffix to check the origin, which leads to bypass via domain like evil-victim.com

func isOriginAllowed(allows []string, origin string) bool {
	for _, o := range allows {
		if o == allOrigins {
			return true
		}

		if strings.HasSuffix(origin, o) {
			return true
		}
	}

	return false
}

PoC

Use code below as a PoC. Only requests from safe.com should bypass the CORS Filter

package main

import (
	"errors"
	"net/http"

	"github.com/zeromicro/go-zero/rest"
)

func main() {
	svr := rest.MustNewServer(rest.RestConf{Port: 8888}, rest.WithRouter(mockedRouter{}), rest.WithCors("safe.com"))
	svr.Start()
}

type mockedRouter struct{}

// some sensitive path
func (m mockedRouter) ServeHTTP(w http.ResponseWriter, r *http.Request) {
	// check user's cookie
	// ...
	// return sensitive data
	w.Write([]byte("social_id: 420101198008292930"))
}

func (m mockedRouter) Handle(_, _ string, handler http.Handler) error {
	return errors.New("foo")
}

func (m mockedRouter) SetNotFoundHandler(_ http.Handler) {
}

func (m mockedRouter) SetNotAllowedHandler(_ http.Handler) {
}

Send a request to localhost:8888 with Origin:not-safe.com You can see the origin reflected in response, which bypass the CORS Filter

Impact

This vulnerability is capable of breaking CORS policy and thus allowing any page to make requests, retrieve data on behalf of other users.

go-zero is a web and rpc framework. Go-zero allows user to specify a CORS Filter with a configurable allows param - which is an array of domains allowed in CORS policy. However, the isOriginAllowed uses strings.HasSuffix to check the origin, which leads to bypass via a malicious domain. This vulnerability is capable of breaking CORS policy and thus allowing any page to make requests and/or retrieve data on behalf of other users. Version 1.4.4 fixes this issue.

go-zero is a web and rpc framework. Go-zero allows user to specify a CORS Filter with a configurable allows param - which is an array of domains allowed in CORS policy. However, the isOriginAllowed uses strings.HasSuffix to check the origin, which leads to bypass via a malicious domain. This vulnerability is capable of breaking CORS policy and thus allowing any page to make requests and/or retrieve data on behalf of other users. Version 1.4.4 fixes this issue.

Summary

Hello go-zero maintainer team, I would like to report a security concerning your CORS Filter feature.

Details

Go-zero allows user to specify a CORS Filter with a configurable allows param - which is an array of domains allowed in CORS policy.

However, the isOriginAllowed uses strings.HasSuffix to check the origin, which leads to bypass via domain like evil-victim.com

func isOriginAllowed(allows []string, origin string) bool {
	for _, o := range allows {
		if o == allOrigins {
			return true
		}

		if strings.HasSuffix(origin, o) {
			return true
		}
	}

	return false
}

PoC

Use code below as a PoC. Only requests from safe.com should bypass the CORS Filter

package main

import (
	"errors"
	"net/http"

	"github.com/zeromicro/go-zero/rest"
)

func main() {
	svr := rest.MustNewServer(rest.RestConf{Port: 8888}, rest.WithRouter(mockedRouter{}), rest.WithCors("safe.com"))
	svr.Start()
}

type mockedRouter struct{}

// some sensitive path
func (m mockedRouter) ServeHTTP(w http.ResponseWriter, r *http.Request) {
	// check user's cookie
	// ...
	// return sensitive data
	w.Write([]byte("social_id: 420101198008292930"))
}

func (m mockedRouter) Handle(_, _ string, handler http.Handler) error {
	return errors.New("foo")
}

func (m mockedRouter) SetNotFoundHandler(_ http.Handler) {
}

func (m mockedRouter) SetNotAllowedHandler(_ http.Handler) {
}

Send a request to localhost:8888 with Origin:not-safe.com You can see the origin reflected in response, which bypass the CORS Filter

Impact

This vulnerability is capable of breaking CORS policy and thus allowing any page to make requests, retrieve data on behalf of other users.

The CORS Filter feature in go-zero allows users to specify an array of domains allowed in the CORS policy. However, the isOriginAllowed function uses strings.HasSuffix to check the origin, which can lead to a bypass via a domain like "evil-victim.com". This vulnerability is capable of breaking CORS policy and thus allowing any page to make requests and retrieve data on behalf of other users.