---
title: "CX-2022-5031"
date: "2022-09-12T07:00:00+00:00"
url: "https://checkmarx.com/zero/vulnerabilities/cx-2022-5031/"
---

# CX-2022-5031

[Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/)

CVE-2022-1996  **Published:** Sep 12, 2022

CWE-639 CWE-639 Authorization Bypass Through User-Controlled Key  9.1 Critical Severity authorization bypass go

@ @ktg9  Reported by Checkmarx Zero

Details Overview

## Summary

Authorization Bypass Through User-Controlled Key in emicklei/go-restful.

## Product

emicklei/go-restful prior to version 3.8.0.

## Impact

This vulnerability is capable of breaking CORS policy and thus allowing any page to make requests, retrieve data on behalf of other users.

## Steps to reproduce

Install go restful and create a file main.go with this content:

```package

import (
    restful "github.com/emicklei/go-restful/v3"
    "io"
    "net/http"
)

func main() {
    container := restful.NewContainer()

    ws := new(restful.WebService)
    ws.Route(ws.GET("hello").To(hello))
    container.Add(ws)
    server := &http.Server{Addr: ":8000", Handler: container}

    //container.Filter(logHeaders)
    cors := restful.CrossOriginResourceSharing{
        ExposeHeaders: []string{"X-My-Header"},
        AllowedDomains: []string{"example.com"},
        CookiesAllowed: true,
        Container: container,
    }
    container.Filter(cors.Filter)
    server.ListenAndServe()
}

func hello(req *restful.Request, resp *restful.Response) {
    io.WriteString(resp, "world")
}
```

In the above code, example.com is configured as an allowed domain.

### Expected result:

Run the above code and access link /hello with Origin Header = example.com.hacker.domain and see that the request gets through CORS policy and response looks like this:

```HTTP/1.1
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: example.com.hacker.domain
Access-Control-Expose-Headers: X-My-Header
Date: Mon, 07 Mar 2022 13:31:08 GMT
Content-Length: 5
Content-Type: text/plain; charset=utf-8
Connection: close

world
```

## Remediation

Update emicklei/go-restful to version 3.8.0.

## Credit

This issue was reported by @ktg9 through huntr.dev.

## Resources

1. [fd3c327](https://github.com/emicklei/go-restful/commit/fd3c327a379ce08c68ef18765bdc925f5d9bad10)
2. [Disclosure](https://huntr.dev/bounties/be837427-415c-4d8c-808b-62ce20aa84f1/)
3. [Advisory](https://github.com/advisories/GHSA-r48q-9g5r-8q2h)

0  Critical Severity CVSS v3.1 Score

   9.1

CVSS v3.1 Vectors- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None

Advisory Timeline1. Disclosed Mar 7, 2022

## Explore more findings

[27 Nov 2025 CVE-2025-34281  Stored Cross-Site Scripting (XSS) in ThingsBoard   6.2  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825  HTTP Response Splitting in cpp-httplib   6.9  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050  Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface   4.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374  Code Injection in UltiMaker Cura   7.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497  Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496  Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [  14 Nov 2024 CVE-2024-51495  Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field   7.5  Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351  Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)