Open Redirect Affecting github.com/go-macaron/macaron Open this link in a new tab package, versions <1.3.7
Exploit Maturity
Proof of concept
Attack Complexity
Low
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications-
snyk-id
SNYK-GOLANG-GITHUBCOMGOMACARONMACARON-568051
-
published
3 May 2020
-
disclosed
3 May 2020
-
credit
ev0A
Introduced: 3 May 2020
CVE-2020-12666 Open this link in a new tabHow to fix?
Upgrade github.com/go-macaron/macaron
to version 1.3.7 or higher.
Overview
github.com/go-macaron/macaron is a high productive and modular web framework in Go.
Affected versions of this package are vulnerable to Open Redirect. It allows remote attackers to redirect users to arbitrary web sites.
PoC by ev0A:
package main
import "gopkg.in/macaron.v1"
func main() {
m := macaron.Classic()
m.Get("/", func(ctx *macaron.Context) string {
return "Hello world!"
})
m.Use(macaron.Static("static"))
m.Run()
}