Description
Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-Scheme without validating that they are supported web schemes. WWWRedirect and NonWWWRedirect use that value to construct a Location header, so an attacker controlling a forwarded scheme header can cause a redirect to use an arbitrary URI scheme. Exploitation requires an affected redirect middleware and user interaction with the response; the HTTPS-specific redirect variants hardcode HTTPS and are unaffected. This issue is fixed in 4.15.2 and 5.1.1.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
labstack echo
>= 5.0.0, < 5.1.1affected< 4.15.2affected
References
- https://github.com/labstack/echo/security/advisories/GHSA-23wf-92cp-8pcj ↗
- https://github.com/labstack/echo/commit/ca4f38a474302aabee93c66bdd0052359882e181 ↗
- https://github.com/labstack/echo/commit/d1d8ad3f99dd9b80542cd0c357d56a8916c515df ↗
- https://github.com/labstack/echo/releases/tag/v4.15.2 ↗
- https://github.com/labstack/echo/releases/tag/v5.1.1 ↗