Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 5.1.1, 4.15.2
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Echo web framework for Go, used to build web applications and APIs, is affected when its WWWRedirect or NonWWWRedirect middleware is enabled. An attacker who can set forwarded scheme headers can make these redirects use an arbitrary URI scheme in the Location header, which may lead to unintended navigation or content being loaded in a user's browser.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-Scheme without validating that they are supported web schemes. WWWRedirect and NonWWWRedirect use that value to construct a Location header, so an attacker controlling a forwarded scheme header can cause a redirect to use an arbitrary URI scheme. Exploitation requires an affected redirect middleware and user interaction with the response; the HTTPS-specific redirect variants hardcode HTTPS and are unaffected. This issue is fixed in 4.15.2 and 5.1.1.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- labstack echo
From 5.0.0 · fixed in 5.1.1; fixed in 4.15.2
- github.com/labstack/echo/v5Go
fixed in 5.1.1
- github.com/labstack/echo/v4Go
fixed in 4.15.2