Authorization Bypass The advisory has been revoked - it doesn't affect any version of package github.com/emicklei/go-restful (opens in a new tab)
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Authorization Bypass vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-GOLANG-GITHUBCOMEMICKLEIGORESTFUL-2435653
- published9 May 2022
- disclosed30 Mar 2022
- creditUnknown
Introduced: 30 Mar 2022
CVE NOT AVAILABLE CWE-285 (opens in a new tab)Amendment
This was deemed not a vulnerability.
Overview
Affected versions of this package are vulnerable to Authorization Bypass when using CORS Filter with a configurable AllowedDomains parameter (which is an array of domains allowed in CORS policy), with the same value as exists in allowedOriginPatterns parameter (used for matching origin using regular expression), it causes for all domains in AllowedDomains to be also used as regular expression for matching origin validation.
This behavior means that if example.com exists in AllowedDomains, all domains starting with example.com would be acceptable, including example.com.hacker.domain.