CVE-2020-24553: XSS Vulnerability in golang
Summary
CVE-2020-24553: Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header. Affects golang across 2 version ranges.
< 1.14.8
>= 1.15.0, < 1.15.1
Fixed in 1.14.8 or 1.15.1, depending on the release line you run. How to fix ↓
Also tracked for
- stdlib · Go
- stdlib · Go
- golang-1.15 · Debian:11
The same CVE-2020-24553 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Golang is an open-source programming language that is designed to be efficient, secure, and easy to use. It is widely used for developing various applications and services. However, a vulnerability has been discovered in versions before 1.14.8 and 1.15.x before 1.15.1 that allows for cross-site scripting (XSS) attacks. This vulnerability specifically affects CGI/FCGI handlers that lack a Content-Type header.
Vulnerability Detail
The XSS vulnerability in golang arises due to the default handling of text/html content type in CGI/FCGI handlers that do not have a Content-Type header. This allows an attacker to inject malicious scripts or HTML code into web pages, leading to potential unauthorized access, data theft, or other malicious activities. The lack of proper input sanitization and validation in affected versions makes it easier for attackers to exploit this vulnerability.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.14.81.14.8 -
>= 1.15.0, < 1.15.11.15.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating golang is not immediately feasible, a temporary workaround can be implemented by manually setting the Content-Type header in the CGI/FCGI handlers. By explicitly specifying the correct content type, such as 'text/plain' or 'application/json', the vulnerability can be mitigated. Here is an example of how to set the Content-Type header in a CGI handler using the 'net/http' package:
package main
import (
"fmt"
"net/http"
)
func main() {
http.HandleFunc("/cgi", func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Content-Type", "text/plain")
fmt.Fprint(w, "Hello, World!")
})
http.ListenAndServe(":8080", nil)
}
Conclusion
The XSS vulnerability in golang can pose a significant security risk to applications and services utilizing affected versions. It is crucial to update golang to version 1.14.8 or 1.15.1 to mitigate this vulnerability. Alternatively, a temporary workaround can be implemented by manually setting the Content-Type header in the CGI/FCGI handlers. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for golang →
FAQ
The XSS vulnerability in golang can allow attackers to inject malicious scripts or HTML code into web pages, potentially leading to unauthorized access, data theft, or other malicious activities.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your manifest file, such as package-lock.json, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this XSS vulnerability in golang.
At the time of this report, there are no known public exploits specifically targeting this XSS vulnerability in golang. However, it is important to promptly update the package to the fixed versions to prevent any potential exploitation.
Yes, a temporary workaround is available by manually setting the Content-Type header in the CGI/FCGI handlers. By explicitly specifying the correct content type, such as 'text/plain' or 'application/json', the vulnerability can be mitigated. However, it is strongly recommended to update golang to the fixed versions as soon as possible.
You can find more information about this vulnerability, including the technical details and the fix, in the official CVE entry at https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24553.
Related vulnerabilities
Recent vulnerabilities recorded for golang.
