CVE-2023-41338

{"id": "CVE-2023-41338", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2023-09-08T19:15:43.977", "references": [{"url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For", "tags": ["Technical Description"], "source": "security-advisories@github.com"}, {"url": "https://docs.gofiber.io/api/ctx#isfromlocal", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/gofiber/fiber/commit/b8c9ede6efa231116c4bd8bb9d5e03eac1cb76dc", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/gofiber/fiber/security/advisories/GHSA-3q5p-3558-364f", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-670"}]}], "descriptions": [{"lang": "en", "value": "Fiber is an Express inspired web framework built in the go language. Versions of gofiber prior to 2.49.2 did not properly restrict access to localhost. This issue impacts users of our project who rely on the `ctx.IsFromLocal` method to restrict access to localhost requests. If exploited, it could allow unauthorized access to resources intended only for localhost. Setting `X-Forwarded-For: 127.0.0.1` in a request from a foreign host, will result in true for `ctx.IsFromLocal`. Access is limited to the scope of the affected process. This issue has been patched in version `2.49.2` with commit `b8c9ede6`. Users are advised to upgrade. There are no known workarounds to remediate this vulnerability without upgrading to the patched version. "}, {"lang": "es", "value": "Fiber es un framework web inspirado en Express creado en el lenguaje Go. Las versiones de gofiber anteriores a la 2.49.2 no restring\u00edan adecuadamente el acceso a localhost. Este problema afecta a los usuarios de nuestro proyecto que dependen del m\u00e9todo `ctx.IsFromLocal` para restringir el acceso a las solicitudes de localhost. Si se explota, podr\u00eda permitir el acceso no autorizado a recursos destinados \u00fanicamente a localhost. Configurar `X-Forwarded-For: 127.0.0.1` en una solicitud de un host externo dar\u00e1 como resultado verdadero para `ctx.IsFromLocal`. El acceso est\u00e1 limitado al alcance del proceso afectado. Este problema se solucion\u00f3 en la versi\u00f3n `2.49.2` con el commit `b8c9ede6`. Se recomienda a los usuarios que actualicen. No se conocen soluciones para remediar esta vulnerabilidad sin actualizar a la versi\u00f3n parcheada."}], "lastModified": "2023-09-12T19:12:29.057", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gofiber:fiber:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DC21F2CF-3B2C-4803-AF42-0377FB5CD6AD", "versionEndExcluding": "2.49.2"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}