UBUNTU-CVE-2019-25211: Critical severity ubuntu/golang-github-gin-contrib-cors vulnerability
parseWildcardRules in Gin-Gonic CORS middleware before 1.6.0 mishandles a wildcard at the end of an origin string, e.g., https://example.community/ is allowed when the intention is that only https://example.com/ should be allowed, and http://localhost.example.com/ is allowed when the intention is that only http://localhost/ should be allowed.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using the Gin-Gonic CORS middleware version before 1.6.0 are exposed if they configure wildcard origin rules intended to restrict requests to a specific origin pattern.
What does an attacker need to exploit the issue?
An attacker needs to make a request with an Origin value that matches the middleware's overly broad wildcard parsing. No authentication or user interaction is required according to the supplied severity vector.
Are default CORS settings affected?
The issue depends on use of wildcard origin rules. The provided information does not indicate that configurations without such rules are affected.
What can be done if updating is not immediately possible?
Avoid wildcard origin patterns and use explicit allowed origins instead, particularly for rules where a trailing wildcard is intended to apply only to a specific hostname or localhost.
How can I check whether an application is affected?
Check whether it uses Gin-Gonic CORS middleware before version 1.6.0 and whether its allowed-origin configuration includes trailing wildcard patterns. Test whether unintended origins such as https://example.community or http://localhost.example.com are accepted for patterns intended for https://example.com or http://localhost.