Wails BindingsAllowedOrigins wildcard origin bypass via suffix match
A lookalike website can secretly call app features in this app-building tool.
Summary
In the Wails desktop app framework, apps that put a wildcard right after an allowed domain can let a lookalike attacker address pass the check and call their Go methods. Versions from 2.0.0 up to, but not including, 2.13.0 are affected.
Affected when
- BindingsAllowedOrigins set with a wildcard right after an allowed domain
- Wails 2.0.0 or later, before 2.13.0
What to do
Update to Wails 2.13.0 or later.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen