Fiber is a web framework written in go. Prior to version 2.52.1, the CORS middleware allows for insecure configurations that could potentially expose the application to multiple CORS-related vulnerabilities. Specifically, it allows setting the Access-Control-Allow-Origin header to a wildcard (`*`) while also having the Access-Control-Allow-Credentials set to true, which goes against recommended security best practices. The impact of this misconfiguration is high as it can lead to unauthorized access to sensitive user data and expose the system to various types of attacks listed in the PortSwigger article linked in the references. Version 2.52.1 contains a patch for this issue. As a workaround, users may manually validate the CORS configurations in their implementation to ensure that they do not allow a wildcard origin when credentials are enabled. The browser fetch api, as well as browsers and utilities that enforce CORS policies, are not affected by this.
The CORS middleware in Gofiber Fiber does not block or warn about the unsafe combination of settings: simultaneous use of wildcard (*) as the allowed origin and enabled credentials (credentials). According to the CORS specification, browsers should reject such responses, however applications and tools not enforcing CORS policy may accept this combination. This allows an attacker to create malicious sites that perform authenticated cross-origin requests to the vulnerable application and read protected resources.
An attacker can gain unauthorized access to sensitive user session data, execute authenticated requests on behalf of the user from any domain, and conduct attacks described in the context of CORS misconfiguration exploitation (including token theft, personal data theft, and other authentication-protected resources).
Gofiber Fiber should be updated to version 2.52.1, which contains a patch for this issue. As a workaround, CORS configuration should be manually verified and ensure that wildcard (*) as an allowed origin is not used simultaneously with enabled credentials (credentials). Instead of wildcard, trusted domains should be explicitly specified.
Gofiber Fiber in versions prior to 2.52.1 with enabled CORS middleware configured with simultaneous use of wildcard origin (*) and Access-Control-Allow-Credentials: true
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:LGofiber Fiber
APPGofiber< 2.52.1
Related vulnerabilities
Przewidywalne UUID w Fiber v2 — podatność na generowanie słabych identyfikatorów
Session Fixation w middleware sesji GoFiber Fiber (wersje < 2.52.5)
CSRF w Gofiber Fiber — wstrzyknięcie wartości i fałszowanie żądań
Fiber is an Express inspired web framework written in Go. A Path Traversal (CWE-22) vulnerability in Fiber all...
Fiber is an Express inspired web framework written in Go. In versions on the v3 branch prior to 3.1.0, the use...