Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 4.16.1, 5.4.1
- Public exploit
- None on Exploit-DB
Summary
The Echo Go web framework's Proxy middleware is affected, so applications that use it to forward WebSocket connections to upstream servers can have route-level authentication or authorization bypassed. An attacker can get later requests on a connection sent straight to the upstream server, skipping Echo's router and route-specific access controls, if the upstream rejects the WebSocket upgrade and the target lacks its own authorization checks.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later HTTP requests on the connection are sent directly to that upstream without passing through Echo's router or route-specific middleware. This can bypass authentication or authorization enforced only by Echo routes, but requires an accessible proxy route, a cooperating rejected-upgrade response, and a target without independent upstream authorization. This issue is fixed in 4.16.1 and 5.4.1.
Affected versions
- labstack echo
From 4.0.0 · fixed in 4.16.1; From 5.0.0 · fixed in 5.4.1