GHSA-qx32-f6g6-fcfr
Access control bypass in beego
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/beego/beego/v2 | < 2.0.3 | 2.0.3 |
| Go | github.com/beego/beego | < 1.12.9 | 1.12.9 |
Details
As written in the advisory (Markdown source, shown as plain text).
The route lookup process in beego prior to 1.12.9 and 2.x prior to 2.0.3 allows attackers to bypass access control. When a /`p1`/`p2`/`:name` route is configured, attackers can access it by appending .xml in various places (e.g., p1.xml instead of p1).
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2022-31259
- https://github.com/beego/beego/issues/4946
- https://github.com/beego/beego/pull/4954
- https://github.com/beego/beego/pull/4958
- https://github.com/beego/beego/commit/228576173a236c81a2122923fcf8099ad294e009
- https://github.com/beego/beego/commit/64cf44d725c8cc35d782327d333df9cbeb1bf2dd
- https://github.com/advisories/GHSA-qx32-f6g6-fcfr
- https://github.com/beego/beego
- https://github.com/beego/beego/tree/v2.0.2
- https://pkg.go.dev/vuln/GO-2022-0463