CVE-2017-20146: Improper access control in github.com/gorilla/handlers
Summary
CVE-2017-20146: Improper access control in github.com/gorilla/handlers. Affects github.com/gorilla/handlers versions < 1.3.0. Fixed in 1.3.0. How to fix ↓
Also tracked for
- golang-github-gorilla-handlers · Debian:11
The same CVE-2017-20146 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The github.com/gorilla/handlers package is a popular Go package that provides various HTTP handlers for the Gorilla web toolkit. It includes functionality for handling CORS (Cross-Origin Resource Sharing) requests. CORS is a mechanism that allows web applications to make requests to a different domain than the one that served the original web page. The handlers package provides a CORS handler that adds the necessary CORS headers to HTTP responses. However, a vulnerability in the package's implementation of the CORS handler allows an attacker to control the value of the Access-Control-Allow-Origin header, bypassing the expected behavior of the Same Origin Policy.
Vulnerability Detail
The vulnerability (CVE-2017-20146) in github.com/gorilla/handlers arises from the improper application of CORS headers. By exploiting this vulnerability, an attacker can manipulate the value of the Access-Control-Allow-Origin header, which should be restricted by the Same Origin Policy. This can lead to various security issues, such as cross-site scripting (XSS) attacks, cross-site request forgery (CSRF) attacks, and information leakage. The vulnerability affects versions 0.0.0 to 1.2.1 of the github.com/gorilla/handlers package.
How To Fix
Minimum fixed version
1.3.0
This is the first release that contains the fix.
go get github.com/gorilla/handlers@v1.3.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the fixed version of the github.com/gorilla/handlers package as soon as possible.
Conclusion
In conclusion, the github.com/gorilla/handlers package is vulnerable to improper access control, allowing an attacker to manipulate the Access-Control-Allow-Origin header. To mitigate this vulnerability, developers should update to version 1.3.0 or later of the package. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/gorilla/handlers →
FAQ
This vulnerability allows an attacker to control the value of the Access-Control-Allow-Origin header, bypassing the Same Origin Policy. This can lead to various security issues, including XSS attacks, CSRF attacks, and information leakage.
Versions 0.0.0 to 1.2.1 of the github.com/gorilla/handlers package are affected by this vulnerability.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
No, there is no known workaround for this vulnerability. It is recommended to update to the fixed version of the github.com/gorilla/handlers package.
You can find more information about this vulnerability in the CVE-2017-20146 entry (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-20146) and the VulnDB entry (https://vuln.go.dev/ID/GO-2020-0020.json).
