x/vulndb: potential Go vuln in github.com/greenpau/caddy-security: CVE-2024-21496

[GoVulnBot]

CVE-2024-21496 references [Path is unknown](https://Path is unknown), which may be a Go module.

Description:
All versions of the package github.com/greenpau/caddy-security are vulnerable to Cross-site Scripting (XSS) via the Referer header, due to improper input sanitization. Although the Referer header is sanitized by escaping some characters that can allow XSS (e.g., [&], [<], [>], ["], [']), it does not account for the attack based on the JavaScript URL scheme (e.g., javascript:alert(document.domain)// payload). Exploiting this vulnerability may not be trivial, but it could lead to the execution of malicious scripts in the context of the target user’s browser, compromising user sessions.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2024-21496
• JSON: https://github.com/CVEProject/cvelist/tree/089b22bf0664d436ab15e62fe0e7a088182fd793/2024/21xxx/CVE-2024-21496.json
• web: https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6249860
• report: Referer-Based Header XSS greenpau/caddy-security#267
• web: https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/
• Imported by: https://pkg.go.dev/Path is unknown?tab=importedby

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: Path is unknown
      packages:
        - package: github.com/greenpau/caddy-security
cves:
    - CVE-2024-21496
references:
    - web: https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6249860
    - report: https://github.com/greenpau/caddy-security/issues/267
    - web: https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/

[gopherbot]

Change https://go.dev/cl/568036 mentions this issue: data/excluded: batch add 23 excluded reports

[gopherbot]

Change https://go.dev/cl/592778 mentions this issue: data/reports: unexclude 80 reports