Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials

🗓️ 22 Feb 2024 18:25:18Reported by GitHub Advisory DatabaseType

Insecure CORS allows wildcard origin with credentials. High impact misconfiguration. Solution involves validating CORS configurations and enforcing secure setup.

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2024-25124	21 Feb 202420:29	–	circl
CNNVD	Fiber Security Breach	21 Feb 202400:00	–	cnnvd
CVE	CVE-2024-25124	21 Feb 202421:01	–	cve
Cvelist	CVE-2024-25124 Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials	21 Feb 202421:01	–	cvelist
EUVD	EUVD-2024-0629	3 Oct 202520:07	–	euvd
NVD	CVE-2024-25124	21 Feb 202421:15	–	nvd
OSV	CVE-2024-25124 Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials	21 Feb 202421:01	–	osv
OSV	GHSA-FMG4-X8PW-HJHG Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials	22 Feb 202418:25	–	osv
OSV	GO-2024-2574 Insecure CORS Configuration allowing wildcard origin with credentials in github.com/gofiber/fiber/v2	20 May 202419:46	–	osv
Prion	Design/Logic Flaw	21 Feb 202421:15	–	prion

Vulners

Node

gofiber fiberRange<2.52.1go

Source	Link
github	www.github.com/gofiber/fiber/security/advisories/GHSA-fmg4-x8pw-hjhg
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-25124
github	www.github.com/gofiber/fiber/commit/f0cd3b44b086544a37886232d0530601f2406c23
codeql	www.codeql.github.com/codeql-query-help/javascript/js-cors-misconfiguration-for-credentials
developer	www.developer.mozilla.org/en-US/docs/Web/HTTP/CORS/Errors/CORSNotSupportingCredentials
fetch	www.fetch.spec.whatwg.org/
github	www.github.com/gofiber/fiber/releases/tag/v2.52.1
saturncloud	www.saturncloud.io/blog/cors-cannot-use-wildcard-in-accesscontrolalloworigin-when-credentials-flag-is-true
blog	www.blog.portswigger.net/2016/10/exploiting-cors-misconfigurations-for.html
github	www.github.com/advisories/GHSA-fmg4-x8pw-hjhg