CVE-2023-24539: golang - Injection of Unexpected HTML via CSS Context
Summary
CVE-2023-24539: Improper sanitization of CSS values in html/template. Affects golang across 2 version ranges.
< 1.19.9
>= 1.20.0, < 1.20.4
Fixed in 1.19.9 or 1.20.4, depending on the release line you run. How to fix ↓
Also tracked for
- golang-1.15 · Debian:11
- stdlib · Go
The same CVE-2023-24539 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The golang package, developed by Bitnami, is an open-source programming language that is widely used for building efficient and reliable software. It provides a rich set of libraries and tools for various applications. However, a vulnerability has been identified in golang that allows for the injection of unexpected HTML via the CSS context.
Vulnerability Detail
The vulnerability in golang arises from the fact that angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. This can lead to unexpected closing of the CSS context and enable the injection of unexpected HTML, especially when executed with untrusted input. The injection of malicious HTML can have severe consequences, such as cross-site scripting (XSS) attacks and unauthorized access to sensitive information.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.19.91.19.9 -
>= 1.20.0, < 1.20.41.20.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can sanitize user input by escaping angle brackets and other potentially dangerous characters before using them in CSS contexts. Here is an example of how to sanitize user input in Go:
import "html"
func sanitizeInput(input string) string {
return html.EscapeString(input)
}
Conclusion
The vulnerability in golang that allows for the injection of unexpected HTML via the CSS context can have severe consequences, including XSS attacks and unauthorized access to sensitive information. It is crucial to update to the latest version of golang (1.20.4 or later) or apply the provided workaround to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for golang →
FAQ
This vulnerability allows an attacker to inject unexpected HTML into a CSS context, which can lead to cross-site scripting (XSS) attacks and unauthorized access to sensitive information.
At the time of this report, there is no known exploit for this vulnerability. However, it is crucial to apply the recommended fix or workaround to prevent any potential exploitation.
No, only versions prior to 1.20.4 are affected. It is recommended to update to the latest version to ensure the security of your application.
Input validation alone is not sufficient to mitigate this vulnerability. While input validation is a good practice, it is essential to update to the fixed version of golang to address the underlying issue.
For more information about this vulnerability, you can refer to the official CVE entry: CVE-2023-24539.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
