CVE-2023-41338 json
Vulnerability in Ctx.IsFromLocal() in gofiber
published 2023-09-08 3 y ago modified 2026-09-10 1 mo ago also GHSA-3q5p-3558-364f , GO-2023-2052 , EUVD-2023-2407
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 51%
- public exploits
- 0
- none known
Summary
Fiber is an Express inspired web framework built in the go language. Versions of gofiber prior to 2.49.2 did not properly restrict access to localhost. This issue impacts users of our project who rely on the `ctx.IsFromLocal` method to restrict access to localhost requests. If exploited, it could allow unauthorized access to resources intended only for localhost. Setting `X-Forwarded-For: 127.0.0.1` in a request from a foreign host, will result in true for `ctx.IsFromLocal`. Access is limited to the scope of the affected process. This issue has been patched in version `2.49.2` with commit `b8c9ede6`. Users are advised to upgrade. There are no known workarounds to remediate this vulnerability without upgrading to the patched version.
Patch / fix
- go github.com/gofiber/fiber/v2 2.49.2, 2.49.2-0.20230906112033-b8c9ede6efa2
- gofiber fiber 2.49.2
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.66% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/gofiber/fiber | <=1.14.6 |
no fix listed |
| go | github.com/gofiber/fiber/v2 | <2.49.2 <2.49.2-0.20230906112033-b8c9ede6efa2 |
2.49.2 2.49.2-0.20230906112033-b8c9ede6efa2 |
Affected products
- gofiber fiber
Classification
- Weakness
-
- CWE-670 Always-Incorrect Control Flow Implementation
References
-
github.com
/gofiber/fiber/commit/b8c9ede6efa231116c4bd8bb9d5e03eac1cb76dc
web, patch
-
github.com
/gofiber/fiber/security/advisories/GHSA-3q5p-3558-364f
web, vendor-advisory, advisory
-
developer.mozilla.org
/en-US/docs/Web/HTTP/Headers/X-Forwarded-For
web, technical-description
-
docs.gofiber.io
/api/ctx#isfromlocal
web, product
-
nvd.nist.gov
/vuln/detail/CVE-2023-41338
advisory
-
github.com
/gofiber/fiber
package
Sources
- CVE List CVE-2023-41338
- GitHub Advisory GHSA-3q5p-3558-364f
- NVD CVE-2023-41338
- OSV GO-2023-2052
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.