Description
Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later HTTP requests on the connection are sent directly to that upstream without passing through Echo's router or route-specific middleware. This can bypass authentication or authorization enforced only by Echo routes, but requires an accessible proxy route, a cooperating rejected-upgrade response, and a target without independent upstream authorization. This issue is fixed in 4.16.1 and 5.4.1.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
labstack echo
>= 4.0.0, < 4.16.1affected>= 5.0.0, < 5.4.1affected
References
- https://github.com/labstack/echo/security/advisories/GHSA-cxf3-9h37-7rr8 ↗
- https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec ↗
- https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f ↗
- https://github.com/labstack/echo/releases/tag/v4.16.1 ↗
- https://github.com/labstack/echo/releases/tag/v5.4.1 ↗