-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGoKEV Misses 88% of Exploited CVEs- Get the report
Miggo AIRoot Cause AnalysisThe vulnerability description states that nosurf failed to check the Referer header for requests it categorized as plain-text HTTP. The provided commit ec9bb776d8e5ba9e906b6eb70428f4e7b009feee shows modifications to handler.go.
The core change is within the (*CSRFHandler).ServeHTTP method. The diff shows the removal of a conditional block that only checked the Referer header if r.URL.Scheme == "https". This conditional check is the direct cause of the vulnerability, as requests not meeting this condition (e.g., HTTP requests, or HTTPS requests where the Go application sees them as HTTP due to a terminating proxy) would bypass the Referer validation.
The patch replaces this flawed inline logic with a call to a new method h.ensureSameOrigin(r), which implements more comprehensive origin verification (checking Sec-Fetch-Site, Origin, and then Referer, with configurable TLS detection).
Therefore, (*CSRFHandler).ServeHTTP is identified as the vulnerable function because it housed the insufficient origin check logic that led to the CSRF vulnerability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/justinas/nosurf | go | < 1.2.0 | 1.2.0 |