Cross-site Request Forgery (CSRF) Affecting github.com/labstack/echo/v4/middleware package, versions <4.16.0

github.com/labstack/echo/v4/middleware is a middleware package for echo.

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) via the MethodOverride middleware in middleware/method_override.go. An attacker can bypass CSRF token and Sec-Fetch-Site checks and trigger a state-changing POST handler without a valid token by submitting a cross-site form POST with _method=GET; configured header or query getters can supply the same override. This requires MethodOverride to run before CSRF in the post-routing middleware chain, and the victim to be authenticated.

Notes

• At the MethodOverride input step, a cross-site form can supply _method=GET only if the middleware uses a form or query getter; the default header getter cannot be set by the form.

Workarounds

• Register MethodOverride with Echo#Pre so routing uses the overridden method and a POST-to-GET request cannot reach a handler registered only for POST.
• Register CSRF middleware before MethodOverride so it validates the original POST before the method can be rewritten.
• Use the default X-HTTP-Method-Override header getter instead of a form or query getter; a cross-site form cannot set that header.

• GitHub Commit
• GitHub Commit
• Maintainer's Advisory