x/vulndb: potential Go vuln in github.com/gin-gonic/gin: CVE-2023-26125

[GoVulnBot]

CVE-2023-26125 references github.com/gin-gonic/gin, which may be a Go module.

Description:
Versions of the package github.com/gin-gonic/gin before 1.9.0 are vulnerable to Improper Input Validation by allowing an attacker to use a specially crafted request via the X-Forwarded-Prefix header, potentially leading to cache poisoning.

Note: Although this issue does not pose a significant threat on its own it can serve as an input vector for other more impactful vulnerabilities. However, successful exploitation may depend on the server configuration and whether the header is used in the application logic.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-26125
• JSON: https://github.com/CVEProject/cvelist/tree/91fcfb9b56db4677ba1e8dacafc13ea53cf89459/2023/26xxx/CVE-2023-26125.json
• web: https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGINGONICGIN-3324285
• fix: t0rchwo0d/gin@fd9f98e
• fix: Add escape logic for header gin-gonic/gin#3500
• fix: Fix #3500 Add escape logic for header gin-gonic/gin#3503
• web: https://github.com/gin-gonic/gin/releases/tag/v1.9.0
• Imported by: https://pkg.go.dev/github.com/gin-gonic/gin?tab=importedby

Cross references:

• Module github.com/gin-gonic/gin appears in issue Include module names #1
• Module github.com/gin-gonic/gin appears in issue x/vulndb: potential Go vuln in github.com/gin-gonic/gin: CVE-2020-28483 #52

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/gin-gonic/gin
    packages:
      - package: github.com/gin-gonic/gin
description: "Versions of the package github.com/gin-gonic/gin before 1.9.0 are vulnerable
    to Improper Input Validation by allowing an attacker to use a specially crafted
    request via the X-Forwarded-Prefix header, potentially leading to cache poisoning.\r\r**Note:**
    Although this issue does not pose a significant threat on its own it can serve
    as an input vector for other more impactful vulnerabilities. However, successful
    exploitation may depend on the server configuration and whether the header is
    used in the application logic.\n"
cves:
  - CVE-2023-26125
references:
  - web: https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGINGONICGIN-3324285
  - fix: https://github.com/t0rchwo0d/gin/commit/fd9f98e70fb4107ee68c783482d231d35e60507b
  - fix: https://github.com/gin-gonic/gin/pull/3500
  - fix: https://github.com/gin-gonic/gin/pull/3503
  - web: https://github.com/gin-gonic/gin/releases/tag/v1.9.0

[jba]

The NIST page says "This vulnerability is currently undergoing analysis and not all information is available. Please check back soon to view the completed vulnerability summary." So not filing a report now.

[saargon]

@jba Looks like the advisory has since been updated, can it be added?

Thanks! :)

[neild]

I'm not seeing the vulnerability here. The report says that this can lead to cache poisoning, but I don't see the path to that outcome. Perhaps I'm missing something.

My inclination is to mark this NOT_A_VULNERABILITY.

[gopherbot]

Change https://go.dev/cl/509516 mentions this issue: data/excluded: batch add 6 excluded reports