CVE-2024-27302

CVE-2024-27302 is a critical vulnerability in the go-zero web and RPC framework (versions prior to 1.4.4) that allows for Cross-Origin Resource Sharing (CORS) policy bypass. The flaw stems from an insecure implementation of the CORS filter's origin check, which uses strings.HasSuffix, enabling malicious domains to circumvent restrictions. This vulnerability has a CVSS score of 9.1 (CRITICAL), indicating it can be exploited remotely with low complexity, potentially leading to high confidentiality and integrity impacts by allowing unauthorized data access and requests. There is currently no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.