-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is a reflected Cross-Site Scripting (XSS) issue in the go-httpbin library. The root cause is that certain endpoints allowed the client to control the Content-Type of the response via a query parameter. When a "dangerous" content type like text/html was provided, the browser would attempt to render the response body as HTML. The application did not properly sanitize or escape user-provided input that was reflected in the response body, leading to XSS.
The analysis of the patch between the vulnerable version v2.17.1 and the patched version v2.18.0 reveals the exact locations of the vulnerability. The patch introduces an allowlist of "safe" content types (text/plain, application/json, application/octet-string). For any other content type, the application now escapes HTML entities in the response body.
The following functions were identified as vulnerable:
HTTPBin.ResponseHeaders: This function handles requests to the /response-headers endpoint. It reflects all query parameters into the response body as a JSON object. Before the patch, it did not escape the keys or values of these parameters. An attacker could craft a URL with Content-Type=text/html and a malicious payload in another parameter, causing the browser to execute the script. The patch adds escaping for the reflected parameters when a potentially dangerous content type is detected.
HTTPBin.Base64: This function handles requests to /base64/{data} and /base64/decode/{data}. It decodes the base64-encoded data from the URL path and includes it in the response body. Similar to the previous function, the Content-Type could be controlled by a query parameter. An attacker could provide a base64-encoded HTML payload with embedded scripts. The patch mitigates this by escaping the decoded data before it is written to the response if the content type is not on the safe list.
The fix involves checking the Content-Type and applying html.EscapeString to the data being reflected in the response, which is handled by the new mustEscapeResponse and isDangerousContentType helper functions.
HTTPBin.ResponseHeadershttpbin/handlers.go
HTTPBin.Base64httpbin/handlers.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/mccutchen/go-httpbin/v2 | go | < 2.18.0 | 2.18.0 |
| github.com/mccutchen/go-httpbin | go | <= 1.1.1 |
GoGo