CVE-2023-24538: golang - Improper Handling of Backticks in Templates
Summary
CVE-2023-24538: Backticks not treated as string delimiters in html/template. Affects golang across 2 version ranges.
< 1.19.8
>= 1.20.0, < 1.20.3
Fixed in 1.19.8 or 1.20.3, depending on the release line you run. How to fix ↓
Also tracked for
- golang-1.15 · Debian:11
- stdlib · Go
The same CVE-2023-24538 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The golang package is a popular open-source programming language that provides a robust set of tools and libraries for building scalable and efficient applications. It is widely used in various domains, including web development, network programming, and system administration. However, the golang package is vulnerable to an issue related to the handling of backticks in templates, which can lead to the injection of arbitrary JavaScript code into Go templates.
Vulnerability Detail
The vulnerability arises from the improper consideration of backticks (`) as JavaScript string delimiters within Go templates. When a template contains a Go template action within a JavaScript template literal, the contents of the action can be used to terminate the literal, allowing for the injection of arbitrary JavaScript code into the Go template. This can lead to various security risks, including cross-site scripting (XSS) attacks and remote code execution. The decision was made to disallow Go template actions from being used inside JavaScript template literals to mitigate this vulnerability.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.19.81.19.8 -
>= 1.20.0, < 1.20.31.20.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The golang package is vulnerable to an issue related to the handling of backticks in templates, which can lead to the injection of arbitrary JavaScript code. To fix this vulnerability, the golang package has introduced a new error handling mechanism. It is recommended to update to the latest version of the package to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for golang →
FAQ
This vulnerability can allow an attacker to inject arbitrary JavaScript code into Go templates, potentially leading to cross-site scripting (XSS) attacks and remote code execution.
Versions 0.0.0 to 1.19.7 and versions 1.20.0 to 1.20.2 of the golang package are affected by this vulnerability.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, the golang package has released fixes for this vulnerability in versions 1.19.8 and 1.20.3. It is recommended to update to the latest version to mitigate the risk.
No, the decision was made to disallow Go template actions inside JavaScript template literals to prevent the injection of arbitrary JavaScript code. This behavior change is intended to enhance security.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
