CVE-2024-27302
Critical
Description
go-zero is a web and rpc framework. Go-zero allows user to specify a CORS Filter with a configurable allows param - which is an array of domains allowed in CORS policy. However, the `isOriginAllowed` uses `strings.HasSuffix` to check the origin, which leads to bypass via a malicious domain. This vulnerability is capable of breaking CORS policy and thus allowing any page to make requests and/or retrieve data on behalf of other users. Version 1.4.4 fixes this issue.
SeverityCritical
CVSS9.1
Exploit probability—
ProductGo-zero
PublishedMar 6, 2024
First seenMar 6, 2024
How to fix
Update
- go-zero go-zero1.4.4 or later
- github.com/zeromicro/go-zero1.4.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| go-zero go-zero | v < 1.4.4 | 1.4.4 |
| github.com/zeromicro/go-zeroGo | v < 1.4.4 | 1.4.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.