Google Go up to 1.14.7/1.15.0 CGI Content-Type Header cross site scripting

Summaryinfo

A vulnerability was found in Google Go up to 1.14.7/1.15.0. It has been declared as problematic. The affected element is an unknown function of the component CGI Handler. Such manipulation as part of Content-Type Header leads to cross site scripting. This vulnerability is listed as CVE-2020-24553. The attack may be performed from remote. In addition, an exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Google Go up to 1.14.7/1.15.0 (Programming Language Software) and classified as problematic. Affected by this issue is some unknown processing of the component CGI Handler. The manipulation as part of a Content-Type Header leads to a cross site scripting vulnerability. Using CWE to declare the problem leads to CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Impacted is integrity. CVE summarizes:

Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.

The weakness was presented 09/02/2020 as not defined mailinglist post (Full-Disclosure). The advisory is shared for download at seclists.org. This vulnerability is handled as CVE-2020-24553 since 08/20/2020. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. Technical details are unknown but a public exploit is available. The MITRE ATT&CK project declares the attack technique as T1059.007.

The exploit is available at packetstormsecurity.com. It is declared as proof-of-concept. The vulnerability scanner Nessus provides a plugin with the ID 210543 (RHEL 8 : Red Hat OpenShift Serverless Client kn 1.12.0 (Moderate) (RHSA-2021:0145)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.14.8 or 1.15.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (210543). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Programming Language Software

Vendor

• Google

Name

• Go

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.14.0
• 1.14.1
• 1.14.2
• 1.14.3
• 1.14.4
• 1.14.5
• 1.14.6
• 1.14.7
• 1.15.0

License

• open-source

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion