Authorization Bypass Through User-Controlled Key in emicklei/go-restful.

Install go restful and create a file main.go with this content:

import (
    restful "github.com/emicklei/go-restful/v3"
    "io"
    "net/http"
)

func main() {
    container := restful.NewContainer()

    ws := new(restful.WebService)
    ws.Route(ws.GET("hello").To(hello))
    container.Add(ws)
    server := &http.Server{Addr: ":8000", Handler: container}

    //container.Filter(logHeaders)
    cors := restful.CrossOriginResourceSharing{
        ExposeHeaders: []string{"X-My-Header"},
        AllowedDomains: []string{"example.com"},
        CookiesAllowed: true,
        Container: container,
    }
    container.Filter(cors.Filter)
    server.ListenAndServe()
}

func hello(req *restful.Request, resp *restful.Response) {
    io.WriteString(resp, "world")
}

In the above code, example.com is configured as an allowed domain.

Expected result:

Run the above code and access link /hello with Origin Header = example.com.hacker.domain and see that the request gets through CORS policy and response looks like this:

Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: example.com.hacker.domain
Access-Control-Expose-Headers: X-My-Header
Date: Mon, 07 Mar 2022 13:31:08 GMT
Content-Length: 5
Content-Type: text/plain; charset=utf-8
Connection: close

world