cve/2019/CVE-2019-25211.md

### [CVE-2019-25211](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25211)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)

### Description

parseWildcardRules in Gin-Gonic CORS middleware before 1.6.0 mishandles a wildcard at the end of an origin string, e.g., https://example.community/* is allowed when the intention is that only https://example.com/* should be allowed, and http://localhost.example.com/* is allowed when the intention is that only http://localhost/* should be allowed.

### POC

#### Reference
- https://github.com/gin-contrib/cors/pull/57

#### Github
- https://github.com/kaisensan/desafio-girus-pick
- https://github.com/w4zu/Debian_security