CVE-2025-24358: Github.com/gorilla/csrf Gorilla/csrf CSRF Vulnerability Due To Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-rq77-p4h8-4crw",
  "modified" : "2025-05-01T12:31:16Z",
  "published" : "2025-04-14T15:26:07Z",
  "aliases" : [ "CVE-2025-24358" ],
  "summary" : "gorilla/csrf CSRF vulnerability due to broken Referer validation",
  "details" : "### Summary\n\ngorilla/csrf is vulnerable to CSRF via form submission from origins that share a top level domain with the target origin.\n\n### Details\n\ngorilla/csrf does not validate the Origin header against an allowlist. Its executes its validation of the Referer header for cross-origin requests only when it believes the request is being served over TLS. It determines this by inspecting the `r.URL.Scheme` value. However, this value is never populated for \"server\" requests [per the Go spec](https://pkg.go.dev/net/http#Request), and so this check does not run in practice. \n```\n\t// URL specifies either the URI being requested (for server\n\t// requests) or the URL to access (for client requests).\n\t//\n\t// For server requests, the URL is parsed from the URI\n\t// supplied on the Request-Line as stored in RequestURI.  For\n\t// most requests, fields other than Path and RawQuery will be\n\t// empty. (See [RFC 7230, Section 5.3](https://rfc-editor.org/rfc/rfc7230.html#section-5.3))\n\t//\n\t// For client requests, the URL's Host specifies the server to\n\t// connect to, while the Request's Host field optionally\n\t// specifies the Host header value to send in the HTTP\n\t// request.\n\tURL *[url](https://pkg.go.dev/net/url).[URL](https://pkg.go.dev/net/url#URL)\n```\n\n### PoC\n\n- create trusted origin `target.example.test` protected with gorilla/csrf and served over TLS hosting form on `/submit`\n- create attacker origin `attack.example.test` served over TLS\n- attacker exfiltrates token & cookie combination from `target.example.test` \n- attacker sets exfiltrated cookie with `domain=.example.test and path=/submit`\n  - as the cookie has a more specific path than `/` (the default for CSRF cookies) it will be sent first by the browser on submit to our target origin\n- submit form from `attack.example.test` with exfiltrated CSRF form token\n- observe valid form submission as `attack.example.test` Origin / Referer headers are not validated. \n\n### Impact\n\nThis vulnerability allows an attacker who has gained XSS on a subdomain or top level domain to perform authenticated form submissions against gorilla/csrf protected targets that share the same top level domain.\n\nThis bug has existed in gorilla/csrf since its initial release in 2015.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/gorilla/csrf"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.7.3"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/gorilla/csrf/security/advisories/GHSA-rq77-p4h8-4crw"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-24358"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/gorilla/csrf/commit/9dd6af1f6d30fc79fb0d972394deebdabad6b5eb"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/gorilla/csrf"
  }, {
    "type" : "WEB",
    "url" : "https://lists.debian.org/debian-lts-announce/2025/05/msg00002.html"
  }, {
    "type" : "WEB",
    "url" : "https://pkg.go.dev/vuln/GO-2025-3607"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-352" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-04-14T15:26:07Z",
    "nvd_published_at" : "2025-04-15T19:16:07Z"
  }
}