CVE-2024-27302

go-zero is a web and rpc framework. Go-zero allows user to specify a CORS Filter with a configurable allows param - which is an array of domains allowed in CORS policy. However, the `isOriginAllowed` uses `strings.HasSuffix` to check the origin, which leads to bypass via a malicious domain. This vulnerability is capable of breaking CORS policy and thus allowing any page to make requests and/or retrieve data on behalf of other users. Version 1.4.4 fixes this issue.

• CWE-639

• https://github.com/zeromicro/go-zero/commit/d9d79e930dff6218a873f4f02115df61c38b15dbPatch
• https://github.com/zeromicro/go-zero/security/advisories/GHSA-fgxv-gw55-r5fqExploit, Vendor Advisory
• https://github.com/zeromicro/go-zero/commit/d9d79e930dff6218a873f4f02115df61c38b15dbPatch
• https://github.com/zeromicro/go-zero/security/advisories/GHSA-fgxv-gw55-r5fqExploit, Vendor Advisory

Published

Mar 6, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-27297Nix is a package manager for Linux and other Unix systems. A…5.9
• CVE-2024-27298parse-server is a Parse Server for Node.js / Express. This v…10
• CVE-2024-27299phpMyFAQ is an open source FAQ web application for PHP 8.1+ …8.8
• CVE-2024-2730Mautic uses predictable page indices for unpublished landing…5.3
• CVE-2024-27300phpMyFAQ is an open source FAQ web application for PHP 8.1+ …5.4
• CVE-2024-27301Support App is an opensource application specialized in mana…7.3
• CVE-2024-27303electron-builder is a solution to package and build a ready …7.3
• CVE-2024-27304pgx is a PostgreSQL driver and toolkit for Go. SQL injection…9.8
• CVE-2024-27305aiosmtpd is a reimplementation of the Python stdlib smtpd.py…5.3
• CVE-2024-27306aiohttp is an asynchronous HTTP client/server framework for …6.1
• CVE-2024-27307JSONata is a JSON query and transformation language. Startin…9.8
• CVE-2024-27308Mio is a Metal I/O library for Rust. When using named pipes …9.1