x/vulndb: potential Go vuln in github.com/casdoor/casdoor: GHSA-mchx-7j67-8mcf

[GoVulnBot]

Advisory GHSA-mchx-7j67-8mcf references a vulnerability in the following Go modules:

Module
github.com/casdoor/casdoor

Description:
Casdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. In Casdoor 1.577.0 and earlier, a logic vulnerability exists in the beego filter CorsFilter that allows any website to make cross domain requests to Casdoor as the logged in user. Due to the a logic error in checking only for a prefix when authenticating the Origin header, any domain can create a valid subdomain with a valid subdomain prefix (Ex: localhost.example.com), allowing the website to make requests to Casdoor as the current signed-in user.

References:

• ADVISORY: GHSA-mchx-7j67-8mcf
• ADVISORY: https://nvd.nist.gov/vuln/detail/CVE-2024-41657
• WEB: https://github.com/casdoor/casdoor/blob/v1.577.0/routers/cors_filter.go#L45
• WEB: https://securitylab.github.com/advisories/GHSL-2024-035_GHSL-2024-036_casdoor

Cross references:

• github.com/casdoor/casdoor appears in 5 other report(s):
  • data/excluded/GO-2023-1868.yaml (x/vulndb: potential Go vuln in github.com/casdoor/casdoor: GHSA-rwcp-qrwg-56cg #1868) EFFECTIVELY_PRIVATE
  • data/reports/GO-2022-0303.yaml (x/vulndb: potential Go vuln in github.com/casdoor/casdoor: CVE-2022-24124 #303)
  • data/reports/GO-2022-1006.yaml (x/vulndb: potential Go vuln in github.com/casdoor/casdoor: CVE-2022-38638, GHSA-9vm3-r8gq-cr6x #1006)
  • data/reports/GO-2022-1153.yaml (x/vulndb: potential Go vuln in github.com/casdoor/casdoor: GHSA-f93f-55c2-8c89 #1153)
  • data/reports/GO-2024-3026.yaml (x/vulndb: potential Go vuln in github.com/casdoor/casdoor: GHSA-67fw-w8f2-88wp #3026)

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/casdoor/casdoor
      vulnerable_at: 1.674.0
summary: Casdoor CORS misconfiguration (GHSL-2024-035) in github.com/casdoor/casdoor
cves:
    - CVE-2024-41657
ghsas:
    - GHSA-mchx-7j67-8mcf
references:
    - advisory: https://github.com/advisories/GHSA-mchx-7j67-8mcf
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-41657
    - web: https://github.com/casdoor/casdoor/blob/v1.577.0/routers/cors_filter.go#L45
    - web: https://securitylab.github.com/advisories/GHSL-2024-035_GHSL-2024-036_casdoor
source:
    id: GHSA-mchx-7j67-8mcf
    created: 2024-08-22T18:01:13.387623328Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/609141 mentions this issue: data/reports: add 21 unreviewed reports