Vulnerability · Published Sep 8, 2023 · Assigned by GitHub_M
CVE-2023-41338Vulnerability in Ctx.IsFromLocal() in gofiber
Medium 5.3
In plain English
A medium-severity security flaw in fiber from gofiber. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Fiber is an Express inspired web framework built in the go language. Versions of gofiber prior to 2.49.2 did not properly restrict access to localhost. This issue impacts users of our project who rely on the `ctx.IsFromLocal` method to restrict access to localhost requests. If exploited, it could allow unauthorized access to resources intended only for localhost. Setting `X-Forwarded-For: 127.0.0.1` in a request from a foreign host, will result in true for `ctx.IsFromLocal`. Access is limited to the scope of the affected process. This issue has been patched in version `2.49.2` with commit `b8c9ede6`. Users are advised to upgrade. There are no known workarounds to remediate this vulnerability without upgrading to the patched version.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/gofiber/fiber | no fix listed | GHSA-3q5p-3558-364f |
| Go | github.com/gofiber/fiber/v2 | 2.49.2 | GHSA-3q5p-3558-364f |
| Go | github.com/gofiber/fiber/v2 | 2.49.2-0.20230906112033-b8c9ede6efa2 | GO-2023-2052 |
Affected products (as reported)
Weakness: CWE-670 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://github.com/gofiber/fiber/security/advisories/GHSA-3q5p-3558-364f x_refsource_CONFIRM
- https://github.com/gofiber/fiber/commit/b8c9ede6efa231116c4bd8bb9d5e03eac1cb76dc x_refsource_MISC
- https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For x_refsource_MISC
- https://docs.gofiber.io/api/ctx#isfromlocal x_refsource_MISC