GHSA-R7W9-592Q-9VG4 Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method

Summary The MethodOverride middleware accepts any non-empty string as the override target method — including safe methods GET, HEAD, OPTIONS, TRACE — when rewriting a POST request. When MethodOverride is registered before CSRF in the post-routing middleware chain e.Use, it rewrites the request...

Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method

Summary The MethodOverride middleware accepts any non-empty string as the override target method — including safe methods GET, HEAD, OPTIONS, TRACE — when rewriting a POST request. When MethodOverride is registered before CSRF in the post-routing middleware chain e.Use, it rewrites the request...