Vulnerability Description
In Fiber before version 1.12.6, the filename that is given in c.Attachment() (https://docs.gofiber.io/ctx#attachment) is not escaped, and therefore vulnerable for a CRLF injection attack. I.e. an attacker could upload a custom filename and then give the link to the victim. With this filename, the attacker can change the name of the downloaded file, redirect to another site, change the authorization header, etc. A possible workaround is to serialize the input before passing it to ctx.Attachment().
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gofiber | Fiber | < 1.12.6 |
Related Weaknesses (CWE)
References
- https://github.com/gofiber/fiber/pull/579/commits/f698b5d5066cfe594102ae252cd58aPatchThird Party Advisory
- https://github.com/gofiber/fiber/security/advisories/GHSA-9cx9-x2gp-9qvhThird Party Advisory
- https://github.com/gofiber/fiber/pull/579/commits/f698b5d5066cfe594102ae252cd58aPatchThird Party Advisory
- https://github.com/gofiber/fiber/security/advisories/GHSA-9cx9-x2gp-9qvhThird Party Advisory
FAQ
What is CVE-2020-15111?
CVE-2020-15111 is a vulnerability with a CVSS score of 4.2 (MEDIUM). In Fiber before version 1.12.6, the filename that is given in c.Attachment() (https://docs.gofiber.io/ctx#attachment) is not escaped, and therefore vulnerable for a CRLF injection attack. I.e. an atta...
How severe is CVE-2020-15111?
CVE-2020-15111 has been rated MEDIUM with a CVSS base score of 4.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-15111?
Check the references section above for vendor advisories and patch information. Affected products include: Gofiber Fiber.