Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/axllent/mailpit | go | >= 1.29.0, <= 1.30.5 | 1.30.6 |
Miggo AIRoot Cause AnalysisThe vulnerability is a cross-site WebSocket hijacking caused by a bypass in the origin validation check. It stems from the interaction of two distinct code components. First, in server/server.go, the middleWareFunc was responsible for checking if an incoming request to an API endpoint had a valid origin. However, it performed this check on the raw request URI (r.RequestURI). Go's HTTP router, ServeMux, makes routing decisions based on the percent-decoded path (r.URL.Path). This allowed an attacker to craft a URL with percent-encoded characters (e.g., /%61pi/events instead of /api/events) that would fail the middleware's prefix check, bypassing the origin validation entirely. Second, after bypassing the middleware, the request would reach the WebSocket handler. In server/websockets/client.go, the websocket.Upgrader was configured with a CheckOrigin function that always returned true, explicitly delegating the check and trusting it had been performed earlier. This combination allowed an attacker to establish a cross-origin WebSocket connection from a malicious website, enabling them to intercept sensitive information streamed over the WebSocket, such as email metadata and snippets.
middleWareFuncserver/server.go
websocket.Upgrader.CheckOriginserver/websockets/client.go