Listen to this Post
The RedirectSlashes function in the go-chi/chi middleware (middleware/strip.go) contains an input validation flaw. It trims all leading and trailing forward slash (‘/’) characters from a request path but does not trim backslashes (‘\’). Starting from version 5.2.2, the function also intentionally omits the Host header from its redirect response to mitigate a separate issue. When a request path like `/\evil.com` is processed, the function returns a redirect with Location: /\evil.com. Modern browsers like Chrome and Firefox interpret the backslash in the Location header, transforming `/\evil.com` into the protocol-relative URL //evil.com. This causes the browser to perform a redirect to http://evil.com`, resulting in an open redirect. The vulnerability allows attackers to craft malicious URLs on a legitimate domain. Users clicking such links are redirected to attacker-controlled sites, enabling phishing or malware distribution. Exploitation requires no authentication and affects default configurations using this middleware.
Platform: go-chi/chi
Version: v5.2.2+
Vulnerability: Open Redirect
Severity: Medium
date: Unknown
<h2 style="color: blue;">Prediction: No patch ETA</h2>
<h2 style="color: blue;">What Undercode Say:</h2>
curl -I localhost:8081/\\evil.com/ curl -I localhost:8081/%5Cevil.com/
package main
import (
"fmt"
"net/http"
"github.com/go-chi/chi/v5"
"github.com/go-chi/chi/v5/middleware"
)
func main() {
r := chi.NewRouter()
r.Use(middleware.RedirectSlashes)
r.Get("/", func(w http.ResponseWriter, r http.Request) {
w.WriteHeader(http.StatusOK)
})
fmt.Println("Server starting on port 8081...")
if err := http.ListenAndServe(":8081", r); err != nil {
fmt.Printf("Error starting server: %v\n", err)
}
}
<h2 style="color: blue;">How Exploit:</h2>
Craft URL with backslash (e.g., http://victim-site/\attacker.com). User's browser visits link. Server returns redirect to/\attacker.com. Browser transforms path to//attacker.com`. Redirects to attacker’s phishing site.
Protection from this CVE
Disable RedirectSlashes middleware. Apply input validation filter. Patch library version.
Impact:
Phishing attacks possible. Credential theft risk. Reputational damage. CVSS 4.7 Medium.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
