x/vulndb: potential Go vuln in github.com/mccutchen/go-httpbin/v2: GHSA-528q-4pgm-wvg2

[GoVulnBot]

Advisory GHSA-528q-4pgm-wvg2 references a vulnerability in the following Go modules:

Module
github.com/mccutchen/go-httpbin
github.com/mccutchen/go-httpbin/v2

Description:

Description

The go-httpbin framework is vulnerable to XSS as the user can control the Response Content-Type from GET parameter. This allows attacker to execute cross site scripts in victims browser.

Affected URLs:

• /response-headers?Content-Type=text/html&xss=%3Cimg/src/onerror=alert(%27xss%27)%3E
• /base64/PGltZy9zcmMvb25lcnJvcj1hbGVydCgneHNzJyk+?content-type=text/html
• /base64/decode/PGltZy9zcmMvb25lcnJvcj1hbGVydCgneHNzJyk+?content-type=text/html

Steps to reproduce:

1. Visit one of the above mentioned URLs.
2. XSS window will popup

Suggested fix

• Allow Only Saf...

References:

• ADVISORY: GHSA-528q-4pgm-wvg2
• ADVISORY: GHSA-528q-4pgm-wvg2
• FIX: mccutchen/go-httpbin@0decfd1
• WEB: https://github.com/mccutchen/go-httpbin/releases/tag/v2.18.0

No existing reports found with this module or alias.
See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/mccutchen/go-httpbin
      vulnerable_at: 1.1.1
    - module: github.com/mccutchen/go-httpbin/v2
      versions:
        - fixed: 2.18.0
      vulnerable_at: 2.17.1
summary: Reflected XSS in go-httpbin due to unrestricted client control over Content-Type in github.com/mccutchen/go-httpbin
ghsas:
    - GHSA-528q-4pgm-wvg2
references:
    - advisory: https://github.com/advisories/GHSA-528q-4pgm-wvg2
    - advisory: https://github.com/mccutchen/go-httpbin/security/advisories/GHSA-528q-4pgm-wvg2
    - fix: https://github.com/mccutchen/go-httpbin/commit/0decfd1a2e88d85ca6bfb8a92421653f647cbc04
    - web: https://github.com/mccutchen/go-httpbin/releases/tag/v2.18.0
source:
    id: GHSA-528q-4pgm-wvg2
    created: 2025-03-21T23:01:23.204971664Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/660559 mentions this issue: data/reports: add 28 reports