CVE-2022-30580: Code Injection in os/exec Package in Bitnami Golang
Summary
CVE-2022-30580: Empty Cmd.Path can trigger unintended binary in os/exec on Windows. Affects golang across 2 version ranges.
< 1.17.11
>= 1.18.0, < 1.18.3
Fixed in 1.17.11 or 1.18.3, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2022-30580 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Bitnami Golang package is an open-source programming language that provides a robust set of tools for building scalable and efficient applications. It is widely used for its simplicity, performance, and extensive standard library. However, a vulnerability has been discovered in the os/exec package before Go 1.17.11 and Go 1.18.3, which allows for code injection when executing certain commands.
Vulnerability Detail
The vulnerability, identified as CVE-2022-30580, originates from a flaw in the Cmd.Start function within the os/exec package. It enables the execution of arbitrary binaries located in the working directory, specifically those named "..com" or "..exe". This vulnerability can be exploited by invoking commands such as Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when the Cmd.Path is unset. The impact of this vulnerability is significant, as it allows an attacker to execute malicious code within the context of the affected application, potentially leading to unauthorized access, data breaches, or system compromise.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.17.111.17.11 -
>= 1.18.0, < 1.18.31.18.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can manually set the Cmd.Path to a trusted binary location instead of leaving it unset. This ensures that only the intended binaries are executed and prevents the exploitation of the code injection vulnerability. Here is an example of how to set the Cmd.Path:
package main
import (
"os/exec"
)
func main() {
cmd := exec.Command("/path/to/binary", "arg1", "arg2")
// Rest of the code
}
Conclusion
In conclusion, the Bitnami Golang package before versions 1.17.11 and 1.18.3 is vulnerable to code injection, allowing for the execution of arbitrary binaries within the working directory. This can have severe consequences, including unauthorized access and data breaches. It is crucial to update to the latest patched version or apply the recommended workaround to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for golang →
FAQ
This vulnerability allows an attacker to execute arbitrary binaries within the working directory, potentially leading to unauthorized access, data breaches, or system compromise.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your manifest file, such as package-lock.json, and Vulert will analyze it in real-time.
No, only versions before Go 1.17.11 and Go 1.18.3 are affected by this vulnerability. It is recommended to update to the latest patched version to mitigate the risk.
At the time of this report, there are no known public exploits targeting this specific vulnerability. However, it is crucial to apply the recommended patches as soon as possible to prevent any potential exploitation.
You can find more information about this vulnerability, including the technical details and the CVE identifier, in the official Bitnami Vulnerability Database at https://vuln.bitnami.com.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
