Google Go up to 1.7.2 x-vulndb origin validation

Summaryinfo

A vulnerability has been found in Google Go up to 1.7.2 and classified as problematic. Impacted is an unknown function of the component x-vulndb. Performing a manipulation results in origin validation. This vulnerability is known as CVE-2025-47909. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as problematic has been found in Google Go up to 1.7.2. This affects an unknown part of the component x-vulndb. The manipulation with an unknown input leads to a origin validation vulnerability. CWE is classifying the issue as CWE-346. The product does not properly verify that the source of data or communication is valid. This is going to have an impact on integrity. The summary by CVE is:

Hosts listed in TrustedOrigins implicitly allow requests from the corresponding HTTP origins, allowing network MitMs to perform CSRF attacks. After the CVE-2025-24358 fix, a network attacker that places a form at http://example.com can't get it to submit to https://example.com because the Origin header is checked with sameOrigin against a synthetic URL. However, if a host is added to TrustedOrigins, both its HTTP and HTTPS origins will be allowed, because the schema of the synthetic URL is ignored and only the host is checked. For example, if an application is hosted on https://example.com and adds example.net to TrustedOrigins, a network attacker can serve a form at http://example.net to perform the attack. Applications should migrate to net/http.CrossOriginProtection, introduced in Go 1.25. If that is not an option, a backport is available as a module at filippo.io/csrf, and a drop-in replacement for the github.com/gorilla/csrf API is available at filippo.io/csrf/gorilla.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2025-47909 since 05/14/2025. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/29/2025).

Upgrading to version 1.7.3 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Programming Language Software

Vendor

• Google

Name

• Go

Version

• 1.7.0
• 1.7.1
• 1.7.2

License

• open-source

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion