nosurf vulnerable to CSRF due to non-functional same-origin request checks 漏洞信息(CVE-2025-46721)

一、漏洞 CVE-2025-46721 基础信息

漏洞信息

                                        # nosurf 由于相同的源请求检查功能不全而易受 CSRF 攻击

N/A

提示

尽管我们采用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。
神龙会尽力确保数据准确，但也请结合实际情况进行甄别与判断。
神龙祝您一切顺利！

漏洞标题

nosurf vulnerable to CSRF due to non-functional same-origin request checks

来源：美国国家漏洞数据库 NVD

漏洞描述信息

nosurf is cross-site request forgery (CSRF) protection middleware for Go. A vulnerability in versions prior to 1.2.0 allows an attacker who controls content on the target site, or on a subdomain of the target site (either via XSS, or otherwise) to bypass CSRF checks and issue requests on user's behalf. Due to misuse of the Go `net/http` library, nosurf categorizes all incoming requests as plain-text HTTP requests, in which case the `Referer` header is not checked to have the same origin as the target webpage. If the attacker has control over HTML contents on either the target website (e.g. `example.com`), or on a website hosted on a subdomain of the target (e.g. `attacker.example.com`), they will also be able to manipulate cookies set for the target website. By acquiring the secret CSRF token from the cookie, or overriding the cookie with a new token known to the attacker, `attacker.example.com` is able to craft cross-site requests to `example.com`. A patch for the issue was released in nosurf 1.2.0. In lieu of upgrading to a patched version of nosurf, users may additionally use another HTTP middleware to ensure that a non-safe HTTP request is coming from the same origin (e.g. by requiring a `Sec-Fetch-Site: same-origin` header in the request).

来源：美国国家漏洞数据库 NVD

CVSS信息

N/A

来源：美国国家漏洞数据库 NVD

漏洞类别

跨站请求伪造(CSRF)

来源：美国国家漏洞数据库 NVD

漏洞标题

nosurf 安全漏洞

来源：中国国家信息安全漏洞库 CNNVD

漏洞描述信息

nosurf是Justinas Stankevičius个人开发者的一个用于 Go 的 HTTP 包。可帮助您防止跨站点请求伪造攻击。 nosurf 1.2.0之前版本存在安全漏洞，该漏洞源于CSRF检查绕过，可能导致跨站请求伪造。

来源：中国国家信息安全漏洞库 CNNVD

CVSS信息

N/A

来源：中国国家信息安全漏洞库 CNNVD

漏洞类别

其他

来源：中国国家信息安全漏洞库 CNNVD

二、漏洞 CVE-2025-46721 的公开POC

#	POC 描述	源链接	神龙链接
1	None	https://github.com/justinas/nosurf-cve-2025-46721	POC详情

三、漏洞 CVE-2025-46721 的情报信息

标题： gorilla/csrf CSRF vulnerability due to broken Referer validation · CVE-2025-24358 · GitHub Advisory Database · GitHub -- 🔗来源链接

标签： x_refsource_MISC
神龙速读
标题： GitHub - justinas/nosurf-cve-2025-46721 -- 🔗来源链接

标签： x_refsource_MISC
神龙速读
标题： Release v1.2.0 · justinas/nosurf · GitHub -- 🔗来源链接

标签： x_refsource_MISC
神龙速读
标题： CSRF due to non-functional same-origin checks in justinas/nosurf · Advisory · justinas/nosurf · GitHub -- 🔗来源链接

标签： x_refsource_CONFIRM
神龙速读
标题： Rework origin checks (#74) · justinas/nosurf@ec9bb77 · GitHub -- 🔗来源链接

标签： x_refsource_MISC
https://nvd.nist.gov/vuln/detail/CVE-2025-46721