Fix for this CVE-2025-47909 is required #204

Activity

1. satishrayavarapu-cmd

   added

   bug

   on Oct 22, 2025
2. shortontech commented on Nov 9, 2025

   

   shortontech

   on Nov 9, 2025

   More actions

   According to the GitHub advisory, this issue is fixed in tagged release v1.7.3
   gorilla/csrf CSRF vulnerability due to broken Referer validation

   It's also in the changelog for the tag here

   👎React with 👎1Reacted by Ray
3. stevenh commented on Dec 17, 2025

   

   stevenh

   on Dec 17, 2025

   More actions

   I don't believe thats the case:

   Hosts listed in TrustedOrigins implicitly allow requests from the corresponding HTTP origins, allowing network MitMs to perform CSRF attacks.

   After the GHSA-rq77-p4h8-4crw fix, a network attacker that places a form at http://example.com/ can't get it to submit to https://example.com/ because the Origin header is checked with sameOrigin against a synthetic URL.

   However, if a host is added to TrustedOrigins, both its HTTP and HTTPS origins will be allowed, because the schema of the synthetic URL is ignored and only the host is checked. For example, if an application is hosted on https://example.com/ and adds example.net to TrustedOrigins, a network attacker can serve a form at http://example.net/ to perform the attack.

   Applications should migrate to net/http.CrossOriginProtection, introduced in Go 1.25. If that is not an option, a backport is available as a module at filippo.io/csrf, and a drop-in replacement for the github.com/gorilla/csrf API is available at filippo.io/csrf/gorilla.

   Affected versions: <= 1.7.3

   👎React with 👎1Reacted by Ray
4. stevenh commented on Dec 17, 2025

   

   stevenh

   on Dec 17, 2025

   More actions

   Also still flagged on pkg.go.dev
   GO-2025-3884: Improper validation of TrustedOrigins allows CSRF attacks in github.com/gorilla/csrf
5. hazcod commented on Dec 31, 2025

   

   hazcod

   on Dec 31, 2025

   More actions

   Can we update the github advisory then to not have v1.7.3 affected?
6. stevenh commented on Jan 4, 2026

   

   stevenh

   on Jan 4, 2026

   More actions

   Can we update the github advisory then to not have v1.7.3 affected?

   Have you proved its not effected?
7. hazcod commented on Jan 4, 2026

   

   hazcod

   on Jan 4, 2026

   More actions

   Can we update the github advisory then to not have v1.7.3 affected?

   Have you proved its not effected?

   https://github.com/gorilla/csrf/releases/tag/v1.7.3 ?
8. stevenh commented on Jan 5, 2026

   

   stevenh

   on Jan 5, 2026

   Last edited by stevenh

   More actions

   That's a different CVE: CVE-2025-24358
9. rayjanoka commented on Jan 26, 2026

   

   rayjanoka

   on Jan 26, 2026

   Last edited by rayjanoka

   More actions

   replacement at https://github.com/FiloSottile/csrf

   The new library uses modern browser headers (Sec-Fetch-Site, Origin) instead of tokens, simplifying the codebase by removing all CSRF token handling from templates and JavaScript.

   How filippo.io/csrf handles older browsers:

   1. Modern browsers (2023+): Sec-Fetch-Site header - explicitly says "same-origin" vs "cross-site"
   2. Older browsers (2012-2023): Falls back to Origin header comparison (supported since Chrome 4, Firefox 4, Safari 5, IE 10)
   3. Very old browsers (no headers): Requests are BLOCKED, not allowed through

   👍React with 👍2Reacted by Steven Hartland and Christophe Colombier