Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI

[ Description ]Official description

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI checks only the first two bytes of a redirect target before deciding whether it begins with an absolute-path separator pair. When AddTrailingSlash or RemoveTrailingSlash is configured with a redirect status, a slash, TAB, separator path form can evade the guard, be emitted in the Location header, and be normalized by a browser into an attacker-controlled host. This issue is fixed in 4.16.0 and 5.4.0.

[ Fixes ]Fixes and patches

• github.com/labstack/echo/v5 5.4.0Fixed version · GitHub Advisories · go package github.com/labstack/echo/v5: upgrade to 5.4.0 or later (affected < 5.4.0)
• github.com/labstack/echo/v4 4.16.0Fixed version · GitHub Advisories · go package github.com/labstack/echo/v4: upgrade to 4.16.0 or later (affected < 4.16.0)

[ Packages ]Affected open-source packages

• github.com/labstack/echo/v5 goAffected < 5.4.0 · fixed in 5.4.0 · GHSA-v753-g4cw-jm48
• github.com/labstack/echo/v4 goAffected < 4.16.0 · fixed in 4.16.0 · GHSA-v753-g4cw-jm48

[ References ]References

• github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1
• github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af
• github.com/labstack/echo/releases/tag/v4.16.0
• github.com/labstack/echo/releases/tag/v5.4.0
• github.com/labstack/echo/security/advisories/GHSA-v753-g4cw-jm48