Vulnerability Details : CVE-2020-15111
In Fiber before version 1.12.6, the filename that is given in c.Attachment() (https://docs.gofiber.io/ctx#attachment) is not escaped, and therefore vulnerable for a CRLF injection attack. I.e. an attacker could upload a custom filename and then give the link to the victim. With this filename, the attacker can change the name of the downloaded file, redirect to another site, change the authorization header, etc. A possible workaround is to serialize the input before passing it to ctx.Attachment().
Products affected by CVE-2020-15111
- cpe:2.3:a:gofiber:fiber:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-15111
0.07%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 28 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-15111
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:N |
8.6
|
4.9
|
NIST | |
|
5.4
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N |
2.8
|
2.5
|
NIST | |
|
4.2
|
MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N |
1.6
|
2.5
|
GitHub, Inc. |
CWE ids for CVE-2020-15111
-
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.Assigned by:
- nvd@nist.gov (Primary)
- security-advisories@github.com (Secondary)
-
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.Assigned by: security-advisories@github.com (Secondary)
References for CVE-2020-15111
-
https://github.com/gofiber/fiber/pull/579/commits/f698b5d5066cfe594102ae252cd58a1fe57cf56f
馃悰 Escape fname by Fenny 路 Pull Request #579 路 gofiber/fiber 路 GitHubPatch;Third Party Advisory
-
https://github.com/gofiber/fiber/security/advisories/GHSA-9cx9-x2gp-9qvh
CRLF vulnerability in c.Attachment() 路 Advisory 路 gofiber/fiber 路 GitHubThird Party Advisory
Jump to