Reliance on Untrusted Inputs in a Security Decision Affecting github.com/labstack/echo/v4/middleware package, versions <4.16.0

github.com/labstack/echo/v4/middleware is a middleware package for echo.

Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the Context.Scheme() method in Echo’s request context. A remote unauthenticated attacker can send X-Forwarded-Proto: https to an HTTP endpoint to bypass HTTPSRedirect, leaving users’ traffic on plaintext HTTP and exposed to interception or modification; behind a TLS-terminating proxy, spoofing X-Forwarded-Proto: http can suppress HSTS. Because WWWRedirect and NonWWWRedirect use Context.Scheme() to build redirect URLs, an attacker can also supply a scheme such as javascript and cause the redirect to use that scheme.

Notes

• At the header-processing step, the attacker must reach the app directly or through a proxy that does not overwrite the spoofed X-Forwarded-Proto; a proxy that overwrites it blocks this attack path.

Workarounds

• If you cannot upgrade, route every request through a proxy that overwrites X-Forwarded-Proto and removes X-Forwarded-Protocol, X-Forwarded-Ssl, and X-Url-Scheme; prevent direct access to the application so clients cannot spoof scheme headers to bypass HTTPS redirects or suppress HSTS.

• GitHub Commit
• GitHub Commit
• Maintainer's Advisory