Description

When request to //interact.sh router, there is no request log and get 301 response. Expected return http status 404.

NOTE. ONLY //interact.sh router can reproduce!

after upgrade gin to golan v1.20 and gin v1.9.0 it disappear.

How to reproduce

package main

import (
    "github.com/gin-gonic/gin"
)

func main() {
    Routes().Run(":3050")
}

func Routes() *gin.Engine {
    r := gin.Default()

    v1 := r.Group("/v1")

    addRoutes(v1)

    return r
}

func addRoutes(r *gin.RouterGroup) {
    r.Group("/api").
        POST("/deploy", deployApp).
        GET("/query", queryToken)
}

Expectations

# curl -vvv 'http://0.0.0.0:3050//interact.sh'

*   Trying 0.0.0.0:3050...
* Connected to 0.0.0.0 (127.0.0.1) port 3050 (#0)
> GET //interact.sh HTTP/1.1
> Host: 0.0.0.0:3050
> User-Agent: curl/7.86.0
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 404 Not Found
< Content-Type: text/plain
< Date: Tue, 28 Mar 2023 08:29:29 GMT
< Content-Length: 18
<
* Connection #0 to host 0.0.0.0 left intact
404 page not found%

Actual result

# curl -vvv 'http://0.0.0.0:3050//interact.sh'

*   Trying 0.0.0.0:3050...
* Connected to 0.0.0.0 (127.0.0.1) port 3050 (#0)
> GET //interact.sh HTTP/1.1
> Host: 0.0.0.0:3050
> User-Agent: curl/7.86.0
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 301 Moved Permanently
< Content-Type: text/html; charset=utf-8
< Location: //interact.sh/
< Date: Tue, 28 Mar 2023 08:30:10 GMT
< Content-Length: 49
<
<a href="//interact.sh/">Moved Permanently</a>.

* Connection #0 to host 0.0.0.0 left intact

Environment

  • go version: 1.17
  • gin version (or commit ref): 1.7.4
  • operating system: macos linux(debian)

Comment From: archfish

CVE-2018-11784

Comment From: archfish

fixed by https://github.com/gin-gonic/gin/pull/3500