A vulnerability, which was classified as critical, has been found in Google Go (Programming Language Software) (affected version not known). Affected by this issue is the function JoinPath/URL.JoinPath. The manipulation with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-24. The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "../" sequences that can resolve to a location that is outside of that directory. Impacted is confidentiality, integrity, and availability. CVE summarizes:

JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", despite the JoinPath documentation stating that ../ path elements are removed from the result.

The weakness was released 09/14/2022. The advisory is available at go.dev. This vulnerability is handled as CVE-2022-32190 since 05/31/2022. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $5k-$25k at the moment (estimation calculated on 10/17/2022). This vulnerability is assigned to T1006 by the MITRE ATT&CK project.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Productinfo

Type

• Programming Language Software

Vendor

• Google

Name

• Go

License

• open-source

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion