CVE-2021-4236 Panic or authentication bypass in github.com/ecnepsnai/web
Attackers can bypass authentication or cause a panic in WebSocket connections if an AuthenticateMethod hook is configured.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-4236?
CVE-2021-4236 is a critical authentication bypass vulnerability in github.com/ecnepsnai/web, published on 27 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Web Sockets do not execute any AuthenticateMethod methods which may be set, leading to a nil pointer dereference if the returned UserData pointer is assumed to be non-nil, or authentication bypass. This issue only affects WebSockets with an AuthenticateMethod hook. Request handlers that do not explicitly use WebSockets are not vulnerable.
Weakness: CWE-476
Which versions are affected by CVE-2021-4236?
5 open source packages ship an affected version, including github.com/ecnepsnai/web. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/ecnepsnai/web Go | From 1.4.0 | 1.5.2 |
github.com/ecnepsnai/web Go | From 1.4.0 | 1.5.2 |
github.com/ecnepsnai/web Go | From 1.4.0 | 1.5.2 |
github.com/ecnepsnai/web Go | From 1.4.0 | 1.5.2 |
github.com/ecnepsnai/web Go | From 1.4.0 | 1.5.2 |
Products include Web Project Web.
How do I fix CVE-2021-4236?
Upgrade github.com/ecnepsnai/web to 1.5.2 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2021-4236 being exploited?
There is no known exploitation of CVE-2021-4236 in the wild and no public exploit code.
Sources
Also known as GHSA-5gjg-jgh4-gppm, GHSA-jpgg-cp2x-qrw3, GO-2021-0107.