Fiber
CVE-2020-15111
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionNVD
In Fiber before version 1.12.6, the filename that is given in c.Attachment() (https://docs.gofiber.io/ctx#attachment) is not escaped, and therefore vulnerable for a CRLF injection attack. I.e. an attacker could upload a custom filename and then give the link to the victim. With this filename, the attacker can change the name of the downloaded file, redirect to another site, change the authorization header, etc. A possible workaround is to serialize the input before passing it to ctx.Attachment().
AnalysisAI
In Fiber before version 1.12.6, the filename that is given in c.Attachment() (https://docs.gofiber.io/ctx#attachment) is not escaped, and therefore vulnerable for a CRLF injection attack. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Technical ContextAI
This vulnerability is classified under CWE-74. In Fiber before version 1.12.6, the filename that is given in c.Attachment() (https://docs.gofiber.io/ctx#attachment) is not escaped, and therefore vulnerable for a CRLF injection attack. I.e. an attacker could upload a custom filename and then give the link to the victim. With this filename, the attacker can change the name of the downloaded file, redirect to another site, change the authorization header, etc. A possible workaround is to serialize the input before passing it to ctx.Attachment(). Affected products include: Gofiber Fiber. Version information: version 1.12.6.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
Fiber is a web framework written in go. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Unbounded memory allocation in Fiber v3 (prior to 3.1.0) allows unauthenticated remote attackers to trigger denial of se
Fiber web framework versions 2 and 3 are vulnerable to denial of service attacks when processing requests to routes cont
Fiber web framework versions 3.0.0 and earlier on Windows contain a path traversal vulnerability that allows remote atta
Fiber is an Express-inspired web framework written in Go A vulnerability present in versions prior to 2.52.5 is a sessio
Go Fiber web framework before 2.52.11 has a weak PRNG vulnerability (on Go < 1.24) that makes session tokens predictable
Fiber is an express inspired web framework written in Go. Rated high severity (CVSS 8.8), this vulnerability is remotely
Fiber is an express inspired web framework written in Go. Rated high severity (CVSS 8.8), this vulnerability is remotely
Fiber is an Express inspired web framework built in the go language. Rated medium severity (CVSS 5.3), this vulnerabilit
Fiber is an Express inspired web framework written in Go. Rated high severity (CVSS 8.7), this vulnerability is remotely
Fiber is an Express-inspired web framework written in Go. Rated high severity (CVSS 7.7), this vulnerability is remotely
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today