CVE-2019-25211 Gin mishandles a wildcard at the end of an origin string
The Gin-Gonic CORS middleware incorrectly validates wildcard origins, allowing attackers to bypass Cross-Origin Resource Sharing restrictions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-25211?
CVE-2019-25211 is a critical vulnerability in n/a, published on 28 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
parseWildcardRules in Gin-Gonic CORS middleware before 1.6.0 mishandles a wildcard at the end of an origin string, e.g., https://example.community/* is allowed when the intention is that only https://example.com/* should be allowed, and http://localhost.example.com/* is allowed when the intention is that only http://localhost/* should be allowed.
Weakness: CWE-346
Which versions are affected by CVE-2019-25211?
5 open source packages ship an affected version, including github.com/gin-contrib/cors and github.com/gin-gonic/gin.
| Package | Affected | Fixed in |
|---|---|---|
github.com/gin-contrib/cors Go | All versions | 1.6.0 |
github.com/gin-contrib/cors Go | All versions | 1.6.0 |
github.com/gin-contrib/cors Go | All versions | 1.6.0 |
github.com/gin-gonic/gin Go | All versions | 1.6.0 |
github.com/gin-gonic/gin Go | All versions | 1.6.0 |
How do I fix CVE-2019-25211?
Upgrade github.com/gin-contrib/cors to 1.6.0 or later.
Is CVE-2019-25211 being exploited?
There is no known exploitation of CVE-2019-25211 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2019-25211, DLA-4285-1, GHSA-869c-j7wc-8jqv, GO-2024-2955, UBUNTU-CVE-2019-25211.