—
GO-2024-2812
Some CORS middleware allow untrusted origins in github.com/jub0bs/fcors
Quick fix
GO-2024-2812 — github.com/jub0bs/fcors: upgrade to the fixed version with the command below.
go get github.com/jub0bs/fcors@v0.9.0Details
Some CORS middleware (more specifically those created by specifying two or more origin patterns whose hosts share a proper suffix) incorrectly allow some untrusted origins, thereby opening the door to cross-origin attacks from the untrusted origins in question.
For example, specifying origin patterns "https://foo.com" and "https://bar.com" (in that order) would yield a middleware that would incorrectly allow untrusted origin "https://barfoo.com".
Are you affected?
Enter the version of the package you're using.