-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/gin-gonic/gin | go | < 1.9.0 | 1.9.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the redirectTrailingSlash function's handling of the X-Forwarded-Prefix header. The original implementation used url.QueryEscape followed by strings.ReplaceAll("%2F", "/"), which failed to properly sanitize special characters. This allowed attackers to inject malicious sequences through the header. The patch replaced this logic with a regex-based sanitization ([^a-zA-Z0-9/-]+) to properly filter unsafe characters. The function's direct involvement in processing untrusted headers and constructing redirect URLs makes it the clear vulnerable entry point. Test case changes in routes_test.go demonstrate how malicious header values were improperly reflected in Location headers before the fix.