CVE-2020-15111
published 2020-07-20CVE-2020-15111: In Fiber before version 1.12.6, the filename that is given in c.Attachment() (https://docs.gofiber.io/ctx#attachment) is not escaped, and therefore vulnerable…
PriorityP426medium5.4CVSS 3.1
AVNACLPRNUIRSUCLILAN
EPSS
0.86%
54.0th percentile
In Fiber before version 1.12.6, the filename that is given in c.Attachment() (https://docs.gofiber.io/ctx#attachment) is not escaped, and therefore vulnerable for a CRLF injection attack. I.e. an attacker could upload a custom filename and then give the link to the victim. With this filename, the attacker can change the name of the downloaded file, redirect to another site, change the authorization header, etc. A possible workaround is to serialize the input before passing it to ctx.Attachment().
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | gofiber_fiber | >= 0 < 1.12.6 | 1.12.6 |
| gofiber | fiber | < 1.12.6 | 1.12.6 |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CRLF vulnerability in Fiber in github.com/gofiber/fiber
osv·2021-07-28
CVE-2020-15111 CRLF vulnerability in Fiber in github.com/gofiber/fiber
CRLF vulnerability in Fiber in github.com/gofiber/fiber
Due to improper input sanitization, a maliciously constructed filename could cause a file download to use an attacker controlled filename, as well as injecting additional headers into an HTTP response.
OSV
CRLF vulnerability in Fiber
osv·2021-06-29
CVE-2020-15111 [MEDIUM] CRLF vulnerability in Fiber
CRLF vulnerability in Fiber
### Impact
The filename that is given in [c.Attachment()](https://docs.gofiber.io/ctx#attachment) is not escaped, and therefore vulnerable for a CRLF injection attack. I.e. an attacker could upload a custom filename and then give the link to the victim. With this filename, the attacker can change the name of the downloaded file, redirect to another site, change the authorization header, etc.
### Steps to reproduce
```go
package main
import "github.com/gofiber/fiber"
const badFileName = "another secret document.pdf\"\r\nLocation: google.com\r\nAuthorization: \"example_of_session_fixation"
func splitTheResponse(c *fiber.Ctx) {
c.Attachment(badFileName)
}
func main() {
app := fiber.New()
app.Get("/attack", splitTheResponse)
app.Listen("127.0.0.1:8080")
}
```
GHSA
CRLF vulnerability in Fiber
ghsa·2021-06-29
CVE-2020-15111 [MEDIUM] CWE-74 CRLF vulnerability in Fiber
CRLF vulnerability in Fiber
### Impact
The filename that is given in [c.Attachment()](https://docs.gofiber.io/ctx#attachment) is not escaped, and therefore vulnerable for a CRLF injection attack. I.e. an attacker could upload a custom filename and then give the link to the victim. With this filename, the attacker can change the name of the downloaded file, redirect to another site, change the authorization header, etc.
### Steps to reproduce
```go
package main
import "github.com/gofiber/fiber"
const badFileName = "another secret document.pdf\"\r\nLocation: google.com\r\nAuthorization: \"example_of_session_fixation"
func splitTheResponse(c *fiber.Ctx) {
c.Attachment(badFileName)
}
func main() {
app := fiber.New()
app.Get("/attack", splitTheResponse)
app.Listen("127.0.0.1:8080")
}
```
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/gofiber/fiber/pull/579/commits/f698b5d5066cfe594102ae252cd58a1fe57cf56fhttps://github.com/gofiber/fiber/security/advisories/GHSA-9cx9-x2gp-9qvhhttps://github.com/gofiber/fiber/pull/579/commits/f698b5d5066cfe594102ae252cd58a1fe57cf56fhttps://github.com/gofiber/fiber/security/advisories/GHSA-9cx9-x2gp-9qvh
2020-07-20
Published