Google Go up to 1.20.11/1.21.4 filepath-safefilepath path traversal

Summaryinfo

A vulnerability categorized as critical has been discovered in Google Go up to 1.20.11/1.21.4. This vulnerability affects unknown code of the component filepath-safefilepath. The manipulation results in path traversal. This vulnerability is identified as CVE-2023-45283. The attack can be executed remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Google Go up to 1.20.11/1.21.4 (Programming Language Software). It has been classified as critical. Affected is an unknown functionality of the component filepath-safefilepath. The manipulation with an unknown input leads to a path traversal vulnerability. CWE is classifying the issue as CWE-23. The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

The filepath package does not recognize paths with a \??\ prefix as special. On Windows, a path beginning with \??\ is a Root Local Device path equivalent to a path beginning with \\?\. Paths with a \??\ prefix may be used to access arbitrary locations on the system. For example, the path \??\c:\x is equivalent to the more common path c:\x. Before fix, Clean could convert a rooted path such as \a\..\??\b into the root local device path \??\b. Clean will now convert this to .\??\b. Similarly, Join(\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \??\b. Join will now convert this to \.\??\b. In addition, with fix, IsAbs now correctly reports paths beginning with \??\ as absolute, and VolumeName correctly reports the \??\ prefix as a volume name.

The weakness was released 11/09/2023. The advisory is shared for download at go.dev. This vulnerability is traded as CVE-2023-45283 since 10/06/2023. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1006.

Upgrading to version 1.20.12 or 1.21.5 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Programming Language Software

Vendor

• Google

Name

• Go

Version

• 1.20.0
• 1.20.1
• 1.20.2
• 1.20.3
• 1.20.4
• 1.20.5
• 1.20.6
• 1.20.7
• 1.20.8
• 1.20.9
• 1.20.10
• 1.20.11
• 1.21.0
• 1.21.1
• 1.21.2
• 1.21.3
• 1.21.4

License

• open-source

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion