GHSA-vrw8-fxc6-2r93 — chi Allows Host Header Injection which Leads to Open Redirect in RedirectSlashes

Affected: Go: github.com/go-chi/chi/v5

### Summary The RedirectSlashes function in middleware/strip.go is vulnerable to host header injection which leads to open redirect.

We consider this a **lower-severity** open redirect, as it can't be exploited from browsers or email clients (requires manipulation of a Host header).

### Details The RedirectSlashes method uses the Host header to construct the redirectURL at this line https://github.com/go-chi/chi/blob/master/middleware/strip.go#L55

The Host header can be manipulated by a user to be any arbitrary host. This leads to open redirect when using the RedirectSlashes middleware

### PoC Create a simple server which uses the RedirectSlashes middleware ``` package main

import ( "fmt" "net/http"

"github.com/go-chi/chi/v5" "github.com/go-chi/chi/v5/middleware" // Import the middleware package )

func main() { // Create a new Chi router r := chi.NewRouter()

// Use the built-in RedirectSlashes middleware r.Use(middleware.RedirectSlashes) // Use middleware.RedirectSlashes

// Define a route handler r.Get("/", func(w http.ResponseWriter, r *http.Request) { // A simple response w.Write([]byte("Hello, World!")) })

// Start the server fmt.Println("Starting server on :8080") http.ListenAndServe(":8080", r) } ``` Run the server `go run main.go`

Once the server is running, send a request that will trigger the RedirectSlashes function with an arbitrary Host header `curl -iL -H "Host: example.com" http://localhost:8080/test/`

Observe that the request will…

Most recent entries from all

GHSA-vrw8-fxc6-2r93 — chi Allows Host Header Injection which Leads to Open Redirect in RedirectSlashes