gorilla/csrf provides Cross Site Request Forgery (CSRF) prevention middleware for Go web applications & services. Prior to 1.7.2, gorilla/csrf does not validate the Origin header against an allowlist. Its executes its validation of the Referer header for cross-origin requests only when it believes the request is being served over TLS. It determines this by inspecting the r.URL.Scheme value. However, this value is never populated for "server" requests per the Go spec, and so this check does not run in practice. This vulnerability allows an attacker who has gained XSS on a subdomain or top level domain to perform authenticated form submissions against gorilla/csrf protected targets that share the same top level domain. This vulnerability is fixed in 1.7.2.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - gorilla/csrf provides Cross Site Request Forgery (CSRF) prevention middleware for Go web applications &     services. Prior to 1.7.2, gorilla/csrf does not validate the Origin header against an allowlist. Its     executes its validation of the Referer header for cross-origin requests only when it believes the request     is being served over TLS. It determines this by inspecting the r.URL.Scheme value. However, this value is     never populated for server requests per the Go spec, and so this check does not run in practice. This     vulnerability allows an attacker who has gained XSS on a subdomain or top level domain to perform     authenticated form submissions against gorilla/csrf protected targets that share the same top level     domain. This vulnerability is fixed in 1.7.2. (CVE-2025-24358)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - gorilla/csrf provides Cross Site Request Forgery (CSRF) prevention middleware for Go web applications &
    services. Prior to 1.7.2, gorilla/csrf does not validate the Origin header against an allowlist. Its
    executes its validation of the Referer header for cross-origin requests only when it believes the request
    is being served over TLS. It determines this by inspecting the r.URL.Scheme value. However, this value is
    never populated for "server" requests per the Go spec, and so this check does not run in practice. This
    vulnerability allows an attacker who has gained XSS on a subdomain or top level domain to perform
    authenticated form submissions against gorilla/csrf protected targets that share the same top level
    domain. This vulnerability is fixed in 1.7.2. (CVE-2025-24358)

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-4151 advisory.

    - --------------------------------------------------------------------------     Debian LTS Advisory DLA-4151-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Andrej Shadura     May 01, 2025                                  https://wiki.debian.org/LTS
    - --------------------------------------------------------------------------

    Package        : golang-github-gorilla-csrf     Version        : 1.6.2-2+deb11u1     CVE ID         : CVE-2025-24358     Debian Bug     : 1103584

    The following vulnerability has been discovered in the gorilla/csrf package for Go:

        Prior to 1.7.3, gorilla/csrf did not validate the Origin header against         an allowlist. It executed its validation of the Referer header for         cross-origin requests only when it believed the request was being         served over TLS. It determined this by inspecting the r.URL.Scheme         value. However, this value was never populated for server requests         per the Go spec, and so this check did not run in practice. This         vulnerability allowed an attacker who has gained XSS on a subdomain         or top level domain to perform authenticated form submissions against         gorilla/csrf protected targets that shared the same top level domain.

    For Debian 11 bullseye, this problem has been fixed in version     1.6.2-2+deb11u1.

    The following Go packages have been rebuilt in order to fix this     issue:

    golang-chroma     golang-github-alecthomas-chroma-dev     golang-github-niklasfasching-go-org-dev     golang-github-yuin-goldmark-highlighting-dev     go-org     hugo

    We recommend that you upgrade these packages.

    For the detailed security status of golang-github-gorilla-csrf please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/golang-github-gorilla-csrf

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
256595	Linux Distros Unpatched Vulnerability : CVE-2025-24358	Nessus	Misc.	medium
434617	SCA: security update for github.com/gorilla/csrf (GHSA-rq77-p4h8-4crw)	Tenable Cloud Security	SCA Checks	medium
434617	SCA: security update for github.com/gorilla/csrf (GHSA-rq77-p4h8-4crw)	Tenable Self-Hosted Container Security	SCA Checks	medium
235057	Debian dla-4151 : golang-github-gorilla-csrf-dev - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2025-24358

medium

Tenable Plugins

medium

medium

medium

medium