GHSA-528q-4pgm-wvg2

Source

https://github.com/advisories/GHSA-528q-4pgm-wvg2

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-528q-4pgm-wvg2/GHSA-528q-4pgm-wvg2.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-528q-4pgm-wvg2

Aliases

GO-2025-3554

Published

2025-03-21T22:29:47Z

Modified

2025-03-25T20:08:37.437698Z

Severity

1.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U CVSS Calculator

Summary

Reflected XSS in go-httpbin due to unrestricted client control over Content-Type

Details

Description

The go-httpbin framework is vulnerable to XSS as the user can control the Response Content-Type from GET parameter. This allows attacker to execute cross site scripts in victims browser.

Affected URLs:

/response-headers?Content-Type=text/html&xss=%3Cimg/src/onerror=alert(%27xss%27)%3E
/base64/PGltZy9zcmMvb25lcnJvcj1hbGVydCgneHNzJyk+?content-type=text/html
/base64/decode/PGltZy9zcmMvb25lcnJvcj1hbGVydCgneHNzJyk+?content-type=text/html

Steps to reproduce:

Visit one of the above mentioned URLs.
XSS window will popup

Suggested fix

Allow Only Safe Content-Type Values Or give users option to define whitelisted Content-Type headers

Criticality

The following can be major impacts of the issue: * Access to victim's sensitive Personal Identifiable Information. * Access to CSRF token * Cookie injection * Phishing * And any other thing Javascript can perform

Database specific

{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-21T22:29:47Z"
}

References

Affected packages

Go / github.com/mccutchen/go-httpbin

Package

Name: github.com/mccutchen/go-httpbin; View open source insights on deps.dev
Purl: pkg:golang/github.com/mccutchen/go-httpbin

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.18.0

Go / github.com/mccutchen/go-httpbin/v2

Package

Name: github.com/mccutchen/go-httpbin/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/mccutchen/go-httpbin/v2

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.18.0