Vulnerability · Published Jun 8, 2023 · Assigned by Go
CVE-2023-29401Improper handling of filenames in Content-Disposition HTTP header in github.com/gin-gonic/gin
Medium 4.3
In plain English
A medium-severity security flaw in github.com/gin-gonic/gin from github.com/gin-gonic/gin. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the Content-Disposition header to be sent with an unexpected filename value or otherwise modify the Content-Disposition header. For example, a filename of "setup.bat";x=.txt" will be sent as a file named "setup.bat". If the FileAttachment function is called with names provided by an untrusted source, this may permit an attacker to cause a file to be served with a name different than provided. Maliciously crafted attachment file name can modify the Content-Disposition header.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | golang-github-gin-gonic-gin | no fix listed | DEBIAN-CVE-2023-29401 |
| Debian:13 | golang-github-gin-gonic-gin | 1.8.1-3 | DEBIAN-CVE-2023-29401 |
| Debian:14 | golang-github-gin-gonic-gin | 1.8.1-3 | DEBIAN-CVE-2023-29401 |
| Go | github.com/gin-gonic/gin | 1.9.1 | GHSA-2c4m-59x9-fr2g |
| Go | github.com/gin-gonic/gin | 1.9.1 | GO-2023-1737 |
| Ubuntu:22.04:LTS | golang-github-gin-gonic-gin | no fix listed | UBUNTU-CVE-2023-29401 |
| Ubuntu:24.04:LTS | golang-github-gin-gonic-gin | no fix listed | UBUNTU-CVE-2023-29401 |
| Ubuntu:25.10 | golang-github-gin-gonic-gin | no fix listed | UBUNTU-CVE-2023-29401 |
| Ubuntu:26.04:LTS | golang-github-gin-gonic-gin | no fix listed | UBUNTU-CVE-2023-29401 |
| Ubuntu:26.10 | golang-github-gin-gonic-gin | no fix listed | UBUNTU-CVE-2023-29401 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| github.com/gin-gonic/gin | github.com/gin-gonic/gin | 1.3.1-0.20190301021747-ccb9e902956d – before 1.9.1 |