Withdrawn by the publisher.

Affected: CleanStart: step

Multiple security vulnerabilities affect the step package. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details.

An Open Redirect vulnerability in the go-chi/chi >=5.2.2 RedirectSlashes function allows remote attackers to redirect victim users to malicious websites using the legitimate website domain.

Affected: Go: github.com/go-chi/chi/v5

### Summary

The `RedirectSlashes` function in middleware/strip.go does not perform correct input validation and can lead to an open redirect vulnerability.

### Details

The `RedirectSlashes` function performs a `Trim` to all forward slash (`/`) characters, while prepending a single one at the begining of the path (Line 52).

However, it does not trim backslashes (`\`).

```go File: middleware/strip.go 41: func RedirectSlashes(next http.Handler) http.Handler { ... 51: // Trim all leading and trailing slashes (e.g., "//evil.com", "/some/path//") 52: path = "/" + strings.Trim(path, "/") ... 62: } ```

Also, from version 5.2.2 onwards the `RedirectSlashes` function does not take into consideration the `Host` Header in the redirect response returned. This was done in order to combat another [[vulnerability](https://github.com/go-chi/chi/security/advisories/GHSA-vrw8-fxc6-2r93)](https://github.com/go-chi/chi/security/advisories/GHSA-vrw8-fxc6-2r93).

The above make it possible for a response in the following form:

``` HTTP/1.1 301 Moved Permanently Location: /\evil.com ```

The `/\evil.com` will be transformed by most browsers (Chrome, Firefox, etc. not Safari) into `//evil.com` which is a protocol relative URL and will result in a redirect to `evil.com`, essentially making it an open redirect vulnerability.

### PoC

A minimal working example can be seen below.

```go package main

import ( "fmt" "net/http"

"github.com/go-chi/chi/v5" "github.com/go-chi/chi/v5/middle…

warewulf4-4.6.5-2.1 on GA media

Security update for warewulf4

Affected: Ubuntu:22.04:LTS: golang-github-go-chi-chi, Ubuntu:24.04:LTS: golang-github-go-chi-chi, Ubuntu:25.10: golang-github-go-chi-chi, Ubuntu:26.04:LTS: golang-github-go-chi-chi

An Open Redirect vulnerability in the go-chi/chi >=5.2.2 RedirectSlashes function allows remote attackers to redirect victim users to malicious websites using the legitimate website domain.