Update module github.com/gofiber/fiber/v2 to v2.52.5 [SECURITY] - autoclosed #31
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v2.31.0
->v2.52.5
GitHub Vulnerability Alerts
CVE-2018-20744
The Olivier Poitrey Go CORS handler through 1.3.0 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible with the CORS security design, and could lead to CORS misconfiguration security problems.
CVE-2023-41338
Impact
This vulnerability can be categorized as a security misconfiguration. It impacts users of our project who rely on the ctx.IsFromLocal() method to restrict access to localhost requests. If exploited, it could allow unauthorized access to resources intended only for localhost.
In it's implementation it uses c.IPs():
Thereby, setting
X-Forwarded-For: 127.0.0.1
in a request from a foreign host, will result in true for ctx.IsFromLocal()Patches
This issue has been patched in
v2.49.2
with commit b8c9ede6efa231116c4bd8bb9d5e03eac1cb76dcWorkarounds
Currently, there are no known workarounds to remediate this vulnerability without upgrading to the patched version. We strongly advise users to apply the patch as soon as it is released.
References
For further information and context regarding this security issue, please refer to the following resources:
CVE-2023-45128
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allows an attacker to inject arbitrary values and forge malicious requests on behalf of a user. This vulnerability can allow an attacker to inject arbitrary values without any authentication, or perform various malicious actions on behalf of an authenticated user, potentially compromising the security and integrity of the application.
Vulnerability Details
The vulnerability is caused by improper validation and enforcement of CSRF tokens within the application. The following issues were identified:
Token Injection: For 'safe' methods, the token was extracted from the cookie and saved to storage without further validation or sanitization.
Lack of Token Association: The CSRF token was validated against tokens in storage but not associated with a session, nor by using a Double Submit Cookie Method, allowing for token reuse.
Specific Go Packages Affected
github.com/gofiber/fiber/v2/middleware/csrf
Remediation
To remediate this vulnerability, it is recommended to take the following actions:
Update the Application: Upgrade the application to a fixed version with a patch for the vulnerability.
Implement Proper CSRF Protection: Review the updated documentation and ensure your application's CSRF protection mechanisms follow best practices.
Choose CSRF Protection Method: Select the appropriate CSRF protection method based on your application's requirements, either the Double Submit Cookie method or the Synchronizer Token Pattern using sessions.
Security Testing: Conduct a thorough security assessment, including penetration testing, to identify and address any other security vulnerabilities.
Defence-in-depth
Users should take additional security measures like captchas or Two-Factor Authentication (2FA) and set Session cookies with SameSite=Lax or SameSite=Secure, and the Secure and HttpOnly attributes.
CVE-2023-45141
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allows an attacker to obtain tokens and forge malicious requests on behalf of a user. This can lead to unauthorized actions being taken on the user's behalf, potentially compromising the security and integrity of the application.
Vulnerability Details
The vulnerability is caused by improper validation and enforcement of CSRF tokens within the application. The following issues were identified:
Remediation
To remediate this vulnerability, it is recommended to take the following actions:
Update the Application: Upgrade the application to a fixed version with a patch for the vulnerability.
Implement Proper CSRF Protection: Review the updated documentation and ensure your application's CSRF protection mechanisms follow best practices.
Choose CSRF Protection Method: Select the appropriate CSRF protection method based on your application's requirements, either the Double Submit Cookie method or the Synchronizer Token Pattern using sessions.
Security Testing: Conduct a thorough security assessment, including penetration testing, to identify and address any other security vulnerabilities.
Defence-in-depth
Users should take additional security measures like captchas or Two-Factor Authentication (2FA) and set Session cookies with SameSite=Lax or SameSite=Strict, and the Secure and HttpOnly attributes.
CVE-2024-25124
The CORS middleware allows for insecure configurations that could potentially expose the application to multiple CORS-related vulnerabilities. Specifically, it allows setting the Access-Control-Allow-Origin header to a wildcard ("*") while also having the Access-Control-Allow-Credentials set to true, which goes against recommended security best practices.
Impact
The impact of this misconfiguration is high as it can lead to unauthorized access to sensitive user data and expose the system to various types of attacks listed in the PortSwigger article linked in the references.
Proof of Concept
The code in cors.go allows setting a wildcard in the AllowOrigins while having AllowCredentials set to true, which could lead to various vulnerabilities.
Potential Solution
Here is a potential solution to ensure the CORS configuration is secure:
Workarounds
For the meantime, users are advised to manually validate the CORS configurations in their implementation to ensure that they do not allow a wildcard origin when credentials are enabled. The browser fetch api, browsers and utilities that enforce CORS policies are not affected by this.
References
MDN Web Docs on CORS Errors
CodeQL on CORS Misconfiguration
PortSwigger on Exploiting CORS Misconfigurations
WhatWG CORS protocol and credentials
CVE-2024-38513
A security vulnerability has been identified in the Fiber session middleware where a user can supply their own session_id value, leading to the creation of a session with that key.
Impact
The identified vulnerability is a session middleware issue in GoFiber versions 2 and above. This vulnerability allows users to supply their own session_id value, resulting in the creation of a session with that key. If a website relies on the mere presence of a session for security purposes, this can lead to significant security risks, including unauthorized access and session fixation attacks. All users utilizing GoFiber's session middleware in the affected versions are impacted.
Patches
The issue has been addressed in the latest patch. Users are strongly encouraged to upgrade to version 2.52.5 or higher to mitigate this vulnerability.
Workarounds
Users who are unable to upgrade immediately can apply the following workarounds to reduce the risk:
References
For more information on session best practices:
Users are encouraged to review these references and take immediate action to secure their applications.
Release Notes
gofiber/fiber (github.com/gofiber/fiber/v2)
v2.52.5
Compare Source
👮 Security
Middleware/session: Session Middleware Token Injection Vulnerability - GHSA-98j2-3j3p-fw2v
https://docs.gofiber.io/api/middleware/session
🧹 Updates
🐛 Bug Fixes
📚 Documentation
Full Changelog: gofiber/fiber@v2.52.4...v2.52.5
Thank you @nyufeng, @PaulTitto and @sixcolors for making this update possible.
v2.52.4
Compare Source
🐛 Fixes
Full Changelog: gofiber/fiber@v2.52.3...v2.52.4
v2.52.3
Compare Source
🐛 Fixes
Full Changelog: gofiber/fiber@v2.52.2...v2.52.3
v2.52.2
Compare Source
🐛 Fixes
Full Changelog: gofiber/fiber@v2.52.1...v2.52.2
v2.52.1
Compare Source
👮 Security
Middleware/cors: Insecure CORS Configuration Allowing Wildcard Origin with Credentials - GHSA-fmg4-x8pw-hjhg
https://docs.gofiber.io/api/middleware/cors
🐛 Fixes
📚 Documentation
Full Changelog: gofiber/fiber@v2.52.0...v2.52.1
Thank you @luk3skyw4lker, @CAEL0, @grivera64, @gaby and @sixcolors for making this update possible.
v2.52.0
Compare Source
🚀 New
https://docs.gofiber.io/api/middleware/healthcheck
🧹 Updates
🛠️ Maintenance
🐛 Fixes
📚 Documentation
Full Changelog: gofiber/fiber@v2.51.0...v2.52.0
Thank you @MehmetFiratKomurcu, @benjajaja, @brunodmartins, @gilwo, @iredmail, @itswcg, @luk3skyw4lker, @muhammadkholidb, @nickajacks1, @sixcolors and @tokelo-12 for making this update possible.
v2.51.0
Compare Source
🚀 New
https://docs.gofiber.io/api/ctx#accepts
https://docs.gofiber.io/api/ctx#json
https://docs.gofiber.io/api/client#json
🧹 Updates
🛠️ Maintenance
🐛 Fixes
📚 Documentation
Full Changelog: gofiber/fiber@v2.50.0...v2.51.0
Thank you @BandhiyaHardik, @database64128, @efectn, @moritz157, @nickajacks1, @rhburt and @sixcolors for making this update possible.
v2.50.0
Compare Source
❗ Breaking Changes
👮 Security
Middleware/csrf: Token Vulnerability (GHSA-mv73-f69x-444p, GHSA-94w9-97p3-p368)
https://docs.gofiber.io/api/middleware/csrf
🚀 Improvements to the CSRF middleware:
SingleUseToken
configuration option.Session
andSessionKey
configuration options.Session
.Thank you @sixcolors
🚀 New
https://docs.gofiber.io/api/ctx#cookieparser
https://docs.gofiber.io/api/middleware/cors#config
https://docs.gofiber.io/api/middleware/session#signatures
Example usage:
https://docs.gofiber.io/api/middleware/session#signatures
Example usage:
🧹 Updates
🛠️ Maintenance
🐛 Fixes
📚 Documentation
Full Changelog: gofiber/fiber@v2.49.2...v2.50.0
Thank you @KaptinLin, @Skyenought, @cuipeiyu, @dairlair, @efectn, @gaby, @geerew, @huykn, @jimmyl02, @joey1123455, @joshlarsen, @jscappini, @peczenyj and @sixcolors for making this update possible.
v2.49.2
Compare Source
🧹 Updates
🐛 Fixes
📚 Documentation
Full Changelog: gofiber/fiber@v2.49.1...v2.49.2
Thank you @11-aryan and @AKARSHITJOSHI for making this update possible.
v2.49.1
Compare Source
🧹 Updates
🐛 Fixes
📚 Documentation
Full Changelog: gofiber/fiber@v2.49.0...v2.49.1
Thank you @KompocikDot, @LimJiAn and @gaby for making this update possible.
v2.49.0
Compare Source
❗ Breaking Changes
https://docs.gofiber.io/api/fiber#config
🚀 New
https://docs.gofiber.io/api/middleware/favicon#config
🧹 Updates
errors.Is
instead ofos.IsNotExist
(#2558)🐛 Fixes
📚 Documentation
Full Changelog: gofiber/fiber@v2.48.0...v2.49.0
Thank you @Jictyvoo, @Juneezee, @Kirari04, @LimJiAn, @PassTheMayo, @andersonmiranda-com, @bigpreshy, @efectn, @renanbastos93, @scandar, @sixcolors and @stefanb for making this update possible.
v2.48.0
Compare Source
🚀 New
https://docs.gofiber.io/guide/hooks#onlisten
https://docs.gofiber.io/api/log
🧹 Updates
🐛 Fixes
📚 Documentation
Full Changelog: gofiber/fiber@v2.47.0...v2.48.0
Thank you @ForAeons, @RHeynsZa, @Saman-Safaei, @Skyenought, @Z3NTL3, @andre-dasilva, @cmd777, @dozheiny, @efectn, @f1rstmehul, @gaby, @itcuihao and @mo1ein for making this update possible.
v2.47.0
Compare Source
🚀 New
https://docs.gofiber.io/api/ctx#queries
https://docs.gofiber.io/api/middleware/logger#config
🧹 Updates
🐛 Fixes
📚 Documentation
Full Changelog: gofiber/fiber@v2.46.0...v2.47.0
Thank you @Kamandlou, @Satont, @Skyenought, @cmd777, @dozheiny, @efectn, @gaby, @kaazedev, @luk3skyw4lker, @obakumen, @sixcolors and @ytsruh for making this update possible.
v2.46.0
Compare Source
🚀 New
🧹 Updates
https://docs.gofiber.io/category/-middleware
🐛 Fixes
📚 Documentation
Full Changelog: gofiber/fiber@v2.45.0...v2.46.0
Thank you @alekseikovrigin, @efectn and @leonklingele for making this update possible.
v2.45.0
Compare Source
🚀 New
https://docs.gofiber.io/api/middleware/filesystem#default-config
🧹 Updates
🐛 Fixes
📚 Documentation
Full Changelog: gofiber/fiber@v2.44.0...v2.45.0
Thank you @Jamess-Lucass, @baichangda, @carmeloriolo, @kanansnote and @kousikmitra for making this update possible.
v2.44.0
Compare Source
🚀 New
https://docs.gofiber.io/api/middleware/cors#config
👮 Security hint
Note: Using this feature is discouraged in production and it's best practice to explicitly set CORS origins via AllowOrigins.
In this example any origin will be allowed via CORS.
For example, if a browser running on http://localhost:3000 sends a request, this will be accepted and the access-control-allow-origin response header will be set to http://localhost:3000.
https://docs.gofiber.io/api/app#server-shutdown
🧹 Updates
🐛 Fixes
https://docs.gofiber.io/next/api/middleware/timeout
❗With version v2.38.1 we changed the behavior of the timeout function, this has now been undone and a function for use with context has been provided
❗The fallback value for not found or not boolean values was adjusted to the golang standard
📚 Documentation
Full Changelog: gofiber/fiber@v2.43.0...v2.44.0
Thank you @Jamess-Lucass, @ancogamer, @cmd777, @dozheiny, @eld4niz, @hakankutluay, @jcyamacho, @leonklingele and @shahriarsohan for making this update possible.
v2.43.0
Compare Source
❗ BreakingChange
Due to the fact that fasthttp, which fiber is based on in release 1.45.0, does not support go version 1.16 anymore, we had to remove it from our package as well.
🚀 New
https://docs.gofiber.io/api/app#listentlswithcertificate
https://docs.gofiber.io/api/app#listenmutualtlswithcertificate
https://docs.gofiber.io/api/ctx#querybool
https://docs.gofiber.io/api/ctx#queryfloat
https://docs.gofiber.io/api/middleware/session
https://docs.gofiber.io/api/middleware/proxy
🧹 Updates
🐛 Fixes
📚 Documentation
gofiber/docs
(#2344)Full Changelog: gofiber/fiber@v2.42.0...v2.43.0
Thank you @CaioAugustoo, @HHongSeungWoo, @IwateKyle, @Rorke76753, @Skyenought, @UtopiaGitHub, @benjajaja, @derkan, @dozheiny, @efectn, @gaby, @leonklingele, @lublak, @msaf1980, @ryand67 and @yvestumushimire for making this update possible.
v2.42.0
Compare Source
🚀 New
https://docs.gofiber.io/api/ctx#queryint
https://docs.gofiber.io/api/middleware/earlydata
https://docs.gofiber.io/api/middleware/idempotency
https://docs.gofiber.io/api/middleware/proxy
🧹 Updates/CI
https://docs.gofiber.io/api/middleware/favicon
🐛 Fixes
app.getString, app.GetBytes
instead ofutils.UnsafeString, utils.UnsafeBytes
inctx.go
(#2297)📚 Documentation
**Full Changel
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.