REDHAT-BUG-2493622: High severity Echo Echo vulnerability
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving %2F as-is), while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an attacker to bypass route-level access controls and read static files without authorization. This vulnerability is fixed in 4.15.3 and 5.2.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Echo (Go web framework)to a version that resolves this vulnerability.Fixed in 4.15.3 - Upgrade
Upgrade
Echo (Go web framework)to a version that resolves this vulnerability.Fixed in 5.2.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Echo versions earlier than 4.15.3 or 5.2.0 are affected when route-level access controls protect content served through the static file handler. The issue arises from differing handling of encoded path separators such as %2F.
What does an attacker need to exploit it?
An attacker needs to send requests containing encoded slashes (%2F) to trigger the mismatch between router matching and static-file path resolution. The vulnerability can allow bypass of route-level authorization and unauthorized reading of static files.
What should be done if an affected version is in use?
Upgrade Echo to version 4.15.3 or 5.2.0. Until upgrading, review whether static-file routes rely on route-level access controls, since those controls may be bypassed with encoded path separators.