GHSA-crxj-hrmp-4rwf

Labstack Echo Open Redirect vulnerability

Source: GitHub Advisory Database (reviewed) Critical CVE-2022-40083

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/labstack/echo/v4	< 4.9.0	4.9.0

Details

As written in the advisory (Markdown source, shown as plain text).

Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component. This vulnerability can be leveraged by attackers to cause a Server-Side Request Forgery (SSRF). Version 4.9.0 contains a patch for the issue.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-40083 advisory
https://github.com/labstack/echo/issues/2259 web
https://github.com/labstack/echo/pull/2260 web
https://github.com/labstack/echo/pull/2260/commits/3154abd1401554fe4d1c09ec550506d8625fc042 web
https://github.com/labstack/echo/commit/0ac4d74402391912ff6da733bb09fd4c3980b4e1 web
https://github.com/labstack/echo package
https://github.com/labstack/echo/releases/tag/v4.9.0 web
https://pkg.go.dev/vuln/GO-2022-1031 web