Description
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI checks only the first two bytes of a redirect target before deciding whether it begins with an absolute-path separator pair. When AddTrailingSlash or RemoveTrailingSlash is configured with a redirect status, a slash, TAB, separator path form can evade the guard, be emitted in the Location header, and be normalized by a browser into an attacker-controlled host. This issue is fixed in 4.16.0 and 5.4.0.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
labstack echo
>= 5.0.0, < 5.4.0affected< 4.16.0affected
References
- https://github.com/labstack/echo/security/advisories/GHSA-v753-g4cw-jm48 ↗
- https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1 ↗
- https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af ↗
- https://github.com/labstack/echo/releases/tag/v4.16.0 ↗
- https://github.com/labstack/echo/releases/tag/v5.4.0 ↗