CVE-2023-29401: Improper handling of filenames in Content-Disposition HTTP header in github.com/gin-gonic/gin
Gin-Gonic Gin Web Framework could allow a remote attacker to bypass security restrictions, caused by improper input validation by the filename parameter of the Context.FileAttachment function. By using a specially-crafted attachment file name, an attacker could exploit this vulnerability to modify the Content-Disposition header.
Other sources
The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the Content-Disposition header to be sent with an unexpected filename value or otherwise modify the Content-Disposition header. For example, a filename of "setup.bat";x=.txt" will be sent as a file named "setup.bat".
If the FileAttachment function is called with names provided by an untrusted source, this may permit an attacker to cause a file to be served with a name different than provided. Maliciously crafted attachment file name can modify the Content-Disposition header.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-29401?
CVE-2023-29401 is a vulnerability in the Gin-Gonic Gin web framework that could allow a remote attacker to bypass security restrictions.
How does CVE-2023-29401 work?
The vulnerability occurs due to the filename parameter of the Context.FileAttachment function not being properly sanitized, allowing a maliciously crafted filename to modify the Content-Disposition header.
What is the severity of CVE-2023-29401?
The severity of CVE-2023-29401 is high with a CVSS score of 7.5.
Which software versions are affected by CVE-2023-29401?
The affected software versions include Gin-Gonic Gin versions between 1.3.1 and 1.9.1, golang-github-gin-gonic-gin version 1.9.1, and github.com/gin-gonic/gin versions between 1.3.1 and 1.9.1.
How can I fix CVE-2023-29401?
To fix CVE-2023-29401, update the Gin-Gonic Gin web framework to version 1.9.1 or higher.