CVE-2023-26125: Input Validation
A flaw was found in Gin-Gonic Gin. This flaw allows a remote attacker to bypass security restrictions caused by improper input validation. An attacker can perform cache poisoning attacks by sending a specially-crafted request using the X-Forwarded-Prefix header.
Other sources
Gin-Gonic Gin could allow a remote attacker to bypass security restrictions, caused by improper input validation. By sending a specially-crafted request using the X-Forwarded-Prefix header, an attacker could exploit this vulnerability to perform cache poisoning attacks.
— IBM
Versions of the package github.com/gin-gonic/gin before 1.9.0 are vulnerable to Improper Input Validation by allowing an attacker to use a specially crafted request via the X-Forwarded-Prefix header, potentially leading to cache poisoning.
Note: Although this issue does not pose a significant threat on its own it can serve as an input vector for other more impactful vulnerabilities. However, successful exploitation may depend on the server configuration and whether the header is used in the application logic.
https://github.com/t0rchwo0d/gin/commit/fd9f98e70fb4107ee68c783482d231d35e60507b https://github.com/gin-gonic/gin/pull/3500 https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGINGONICGIN-3324285 https://github.com/gin-gonic/gin/pull/3503 https://github.com/gin-gonic/gin/releases/tag/v1.9.0
— Red Hat
Versions of the package github.com/gin-gonic/gin before version 1.9.0 are vulnerable to Improper Input Validation by allowing an attacker to use a specially crafted request via the X-Forwarded-Prefix header, potentially leading to cache poisoning.
Note: Although this issue does not pose a significant threat on its own it can serve as an input vector for other more impactful vulnerabilities. However, successful exploitation may depend on the server configuration and whether the header is used in the application logic.
— GitHub
Affected Software
Remediation
Patch Available
Patch Available
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this flaw in Gin-Gonic Gin?
The vulnerability ID for this flaw in Gin-Gonic Gin is CVE-2023-26125.
What is the severity of CVE-2023-26125?
The severity of CVE-2023-26125 is high with a severity value of 7.3.
How does CVE-2023-26125 affect the Gin-Gonic Gin package?
CVE-2023-26125 affects versions of the Gin-Gonic Gin package before version 1.9.0.
How can an attacker exploit CVE-2023-26125?
An attacker can exploit CVE-2023-26125 by using a specially crafted request via the X-Forwarded-Prefix header, potentially leading to cache poisoning.
Is there a fix available for CVE-2023-26125?
Yes, the fix for CVE-2023-26125 is to upgrade to version 1.9.0 or later of the Gin-Gonic Gin package.