CVE-2025-24358: gorilla/csrf CSRF Validation Vulnerability

CVE-2025-24358 Overview

CVE-2025-24358 is a Cross-Site Request Forgery (CSRF) protection bypass vulnerability in the gorilla/csrf middleware for Go web applications. The vulnerability exists because the middleware does not validate the Origin header against an allowlist and fails to properly execute Referer header validation for cross-origin requests. The middleware attempts to validate the Referer header only when it believes the request is being served over TLS, which it determines by inspecting the r.URL.Scheme value. However, according to the Go specification, this value is never populated for "server" requests, meaning this critical security check does not run in practice.

Critical Impact
An attacker who has gained XSS on a subdomain or top-level domain can perform authenticated form submissions against gorilla/csrf protected targets that share the same top-level domain, effectively bypassing CSRF protections.

Affected Products

gorilla/csrf versions prior to 1.7.2
Go web applications using the vulnerable gorilla/csrf middleware
Services sharing top-level domains with compromised subdomains

Discovery Timeline

April 15, 2025 - CVE-2025-24358 published to NVD
May 01, 2025 - Last updated in NVD database

Technical Details for CVE-2025-24358

Vulnerability Analysis

The gorilla/csrf middleware is designed to protect Go web applications against Cross-Site Request Forgery attacks by validating request origins. However, a fundamental flaw in the implementation renders a key security check ineffective. The middleware relies on examining the r.URL.Scheme field to determine whether a request is being served over TLS before executing Referer header validation for cross-origin requests. According to Go's HTTP specification, the r.URL.Scheme field is never populated for incoming server requests—it remains empty. As a result, the middleware incorrectly concludes that requests are not served over TLS and skips the critical Referer header validation entirely.

Additionally, the middleware lacks any validation of the Origin header against an allowlist, creating another vector for cross-origin attacks. This combination of missing and broken checks allows attackers to craft malicious requests that bypass CSRF protections.

Root Cause

The root cause stems from two implementation flaws in the gorilla/csrf middleware:

Incorrect TLS Detection: The middleware uses r.URL.Scheme to detect TLS connections, but this field is never populated for server-side requests in Go, causing the Referer validation to be skipped.
Missing Origin Allowlist: The middleware does not validate the Origin header against a configurable allowlist, allowing cross-origin requests from potentially malicious domains.

Attack Vector

The attack requires the following conditions:

The attacker must first gain XSS capabilities on a subdomain or top-level domain that shares the same top-level domain as the target application
The target application must use gorilla/csrf versions prior to 1.7.2 for CSRF protection
The attacker leverages the XSS position to craft authenticated form submissions against the CSRF-protected target

Once these conditions are met, the attacker can submit forged requests on behalf of authenticated users without the CSRF token validation being properly enforced, as the Origin/Referer checks fail to execute.

The security patch introduces proper context handling and slices package for improved validation:

 package csrf
 
 import (
+	"context"
 	"errors"
 	"fmt"
 	"net/http"
 	"net/url"
+	"slices"
 
 	"github.com/gorilla/securecookie"
 )

Source: GitHub Commit Update

Detection Methods for CVE-2025-24358

Indicators of Compromise

Unexpected authenticated form submissions originating from external or subdomain referrers
Cross-origin POST requests to protected endpoints without proper CSRF token validation
Web server logs showing form submissions with mismatched or missing Origin/Referer headers from legitimate sessions
Unusual activity patterns from authenticated user sessions indicating unauthorized actions

Detection Strategies

Review application dependencies for gorilla/csrf versions prior to 1.7.2
Audit web server logs for cross-origin form submissions to protected endpoints
Monitor for XSS indicators on subdomains that could be leveraged for CSRF attacks
Implement application-layer monitoring for suspicious authenticated request patterns

Monitoring Recommendations

Enable verbose logging for CSRF middleware to capture validation decisions
Set up alerts for form submissions from unexpected Origin or Referer headers
Monitor for dependency vulnerability alerts in Go module management tools
Implement security scanning in CI/CD pipelines to detect vulnerable package versions

How to Mitigate CVE-2025-24358

Immediate Actions Required

Update gorilla/csrf to version 1.7.2 or later immediately
Review all applications using gorilla/csrf middleware and schedule upgrades
Audit subdomains for XSS vulnerabilities that could be chained with this attack
Consider implementing additional Origin header validation at the application layer as defense-in-depth

Patch Information

The vulnerability is fixed in gorilla/csrf version 1.7.2. The patch introduces proper Origin header validation against an allowlist and corrects the TLS detection mechanism. Security updates have also been released through Debian LTS. For complete details on the fix, refer to the GitHub Security Advisory and the security commit.

Workarounds

Implement application-level Origin header validation until the patch can be applied
Restrict subdomain access and audit for XSS vulnerabilities to prevent the initial attack vector
Use network segmentation to isolate applications that cannot be immediately patched
Deploy web application firewall (WAF) rules to detect and block suspicious cross-origin form submissions

bash

# Update gorilla/csrf to patched version
go get -u github.com/gorilla/csrf@v1.7.2
go mod tidy