Open Redirect Affecting github.com/go-macaron/macaron package, versions <1.3.7
Snyk CVSS
Attack Complexity
Low
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.11% (43rd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GITHUBCOMGOMACARONMACARON-568051
- published 3 May 2020
- disclosed 3 May 2020
- credit ev0A
Introduced: 3 May 2020
CVE-2020-12666 Open this link in a new tabHow to fix?
Upgrade github.com/go-macaron/macaron
to version 1.3.7 or higher.
Overview
github.com/go-macaron/macaron is a high productive and modular web framework in Go.
Affected versions of this package are vulnerable to Open Redirect. It allows remote attackers to redirect users to arbitrary web sites.
PoC by ev0A:
package main
import "gopkg.in/macaron.v1"
func main() {
m := macaron.Classic()
m.Get("/", func(ctx *macaron.Context) string {
return "Hello world!"
})
m.Use(macaron.Static("static"))
m.Run()
}