CVE-2025-24358

What it actually does

The gorilla/csrf middleware skips Origin header allowlist validation entirely and only attempts Referer header checks for cross-origin requests when r.URL.Scheme indicates TLS; because Go server requests never populate r.URL.Scheme, the Referer check never executes, permitting authenticated form submissions from any origin sharing the same top-level domain.

Why it matters to the business

Compromise of a single subdomain via XSS can be escalated to unauthorized state-changing actions against any application using the vulnerable library on the same parent domain, increasing the blast radius of web application compromises and potential data integrity loss.

How an attack unfolds

An attacker first obtains XSS on a subdomain or top-level domain that shares the parent domain with the target application; they then craft cross-origin form POST requests that are accepted because neither Origin nor Referer validation runs, resulting in authenticated actions being performed on behalf of the victim user.

How to fix it

Upgrade gorilla/csrf to version 1.7.2 or later (commit 9dd6af1f6d30fc79fb0d972394deebdabad6b5eb); enable explicit Origin header allow-listing in application configuration after upgrade.

How to confirm the fix worked

Inspect the gorilla/csrf import path and module version in go.mod or vendor directory; confirm the presence of Origin header validation logic and removal of the r.URL.Scheme dependency for Referer checks in the running binary or source.

Typical attack path

1. Obtain XSS execution on a subdomain or parent domain sharing the target's TLD
2. Craft and deliver cross-origin authenticated form submissions
3. Bypass CSRF checks due to absent Origin validation and non-functional Referer logic
4. Perform unauthorized state-changing operations

How to detect it

Review application access and error logs for cross-origin POST requests lacking expected Origin or Referer headers; correlate with known XSS indicators on subdomains sharing the parent domain.

What your security team should do

• Immediately upgrade all instances of gorilla/csrf to 1.7.2 or the referenced commit
• Audit all Go web applications for use of this library and verify Origin allow-list configuration
• Add defense-in-depth by enforcing SameSite cookies and additional custom Origin checks where feasible