-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the nextOrIndex handler in controllers/route.go, which processes the 'next' parameter for redirects. The pre-patch code used url.Path from the parsed URL, which doesn't properly resolve escaped paths or multiple leading slashes. Attackers could exploit this by providing values like '\example.com' which browsers interpret as absolute URLs. The patch explicitly uses EscapedPath() and adds slash normalization via strings.TrimLeft, confirming this was the vulnerable code path. The function's direct involvement in processing untrusted user input for redirects and the specific patch targeting this handler provide high confidence in this assessment.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/gophish/gophish | go | < 0.12.0 | 0.12.0 |