GHSA-2c4m-59x9-fr2g
Gin Web Framework does not properly sanitize filename parameter of Context.FileAttachment function
At a glance
- Published
- Updated
- CVE
- CVE-2023-29401
- Aliases
- GO-2023-1737
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Description
The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the Content-Disposition header to be sent with an unexpected filename value or otherwise modify the Content-Disposition header. For example, a filename of "setup.bat";x=.txt" will be sent as a file named "setup.bat". If the FileAttachment function is called with names provided by an untrusted source, this may permit an attacker to cause a file to be served with a name different than provided. Maliciously crafted attachment file name can modify the Content-Disposition header.
Affected packages
| Package | Versions |
|---|---|
| Go · github.com/gin-gonic/gin | introduced 1.3.1-0.20190301021747-ccb9e902956d, fixed 1.9.1 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-29401 ADVISORY
- https://github.com/gin-gonic/gin/issues/3555 WEB
- https://github.com/gin-gonic/gin/pull/3556 WEB
- https://github.com/gin-gonic/gin PACKAGE
- https://github.com/gin-gonic/gin/releases/tag/v1.9.1 WEB
- https://pkg.go.dev/vuln/GO-2023-1737 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |