CVE-2024-27302

Published: Mar 6, 2024Modified: Dec 3, 2025

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 3.9 / Impact: 5.2

Source: security-advisories@github.com (Secondary)

Description

go-zero is a web and rpc framework. Go-zero allows user to specify a CORS Filter with a configurable allows param - which is an array of domains allowed in CORS policy. However, the `isOriginAllowed` uses `strings.HasSuffix` to check the origin, which leads to bypass via a malicious domain. This vulnerability is capable of breaking CORS policy and thus allowing any page to make requests and/or retrieve data on behalf of other users. Version 1.4.4 fixes this issue.

Affected (1)

Products: Go Zero: Go Zero

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Go Zero Go Zero	Before 1.4.4

Related CWEs

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (4)

https://github.com/zeromicro/go-zero/commit/d9d79e930dff6218a873f4f02115df61c38b15db

Source: security-advisories@github.com

Patch

https://github.com/zeromicro/go-zero/security/advisories/GHSA-fgxv-gw55-r5fq

Source: security-advisories@github.com

ExploitVendor Advisory

https://github.com/zeromicro/go-zero/commit/d9d79e930dff6218a873f4f02115df61c38b15db

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/zeromicro/go-zero/security/advisories/GHSA-fgxv-gw55-r5fq

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitVendor Advisory

Timeline

No history available yet.