CVE-2021-4236: Panic or authentication bypass in github.com/ecnepsnai/web
Summary
CVE-2021-4236: ecnepsnai/web vulnerable to Uncontrolled Resource Consumption. Affects github.com/ecnepsnai/web versions >= 1.4.0, < 1.5.2. Fixed in 1.5.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/ecnepsnai/web is a Go package that provides a web server framework. It includes functionality for handling web socket connections. Web sockets allow for real-time communication between a client and a server. The package includes an AuthenticateMethod hook that can be used to authenticate web socket connections. However, there is a vulnerability in the package that can lead to a panic or authentication bypass when using web sockets with an AuthenticateMethod hook.
Vulnerability Detail
The vulnerability occurs because the Web Sockets in github.com/ecnepsnai/web do not execute any AuthenticateMethod methods that may be set. This can result in a nil pointer dereference if the returned UserData pointer is assumed to be non-nil, or it can lead to authentication bypass. This means that an attacker could potentially bypass authentication and gain unauthorized access to web socket connections. It's important to note that this vulnerability only affects web sockets with an AuthenticateMethod hook. Request handlers that do not explicitly use web sockets are not vulnerable.
How To Fix
Minimum fixed version
1.5.2
This is the first release that contains the fix.
go get github.com/ecnepsnai/web@v1.5.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in github.com/ecnepsnai/web can lead to a panic or authentication bypass when using web sockets with an AuthenticateMethod hook. Developers should update to version 1.5.2 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/ecnepsnai/web →
FAQ
The impact of this vulnerability is that an attacker could potentially bypass authentication and gain unauthorized access to web socket connections.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file and the playground will analyze it for vulnerabilities.
No, only versions 1.4.0 to 1.5.1 of github.com/ecnepsnai/web are affected by this vulnerability. Version 1.5.2 and later include a fix for the vulnerability.
Yes, developers using github.com/ecnepsnai/web should update to version 1.5.2 or later to patch this vulnerability.
There is no known exploit for this vulnerability at this time.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/ecnepsnai/web.
