GHSA-vrw8-fxc6-2r93
MediumSummary
The RedirectSlashes function in middleware/strip.go is vulnerable to host header injection leading to an open redirect. This is considered lower-severity as it cannot be exploited from browsers or email clients.
Risk Assessment
An attacker can redirect users to a malicious site by manipulating the Host header, potentially leading to data leakage or phishing, but requires specific conditions.
Recommendation
Update the library to the latest version that includes a fix for this vulnerability. If an update is not possible, consider disabling the RedirectSlashes function or adding Host header validation.
Original NVD description (English source)
### Summary The RedirectSlashes function in middleware/strip.go is vulnerable to host header injection which leads to open redirect. We consider this a **lower-severity** open redirect, as it can't be exploited from browsers or email clients (requires manipulation of a Host header). ### Details Th