CVE-2023-24540: golang - Improper Sanitization of Whitespace Characters in JavaScript Contexts
Summary
CVE-2023-24540: Improper handling of JavaScript whitespace in html/template. Affects golang across 2 version ranges.
< 1.19.9
>= 1.20.0, < 1.20.4
Fixed in 1.19.9 or 1.20.4, depending on the release line you run. How to fix ↓
Also tracked for
- golang-1.15 · Debian:11
- stdlib · Go
The same CVE-2023-24540 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The golang package, developed by Bitnami, is a popular open-source programming language that provides a robust set of tools and libraries for building scalable and efficient applications. It is widely used for its simplicity, performance, and extensive standard library. However, the golang package is vulnerable to an issue related to the improper sanitization of whitespace characters in JavaScript contexts.
Vulnerability Detail
This vulnerability arises from the fact that not all valid JavaScript whitespace characters are considered to be whitespace in golang. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution. This can lead to potential security risks, such as code injection or cross-site scripting (XSS) attacks, as the untrusted input may be executed or rendered in an unsafe manner.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.19.91.19.9 -
>= 1.20.0, < 1.20.41.20.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating the golang package is not immediately feasible, a temporary workaround can be implemented by manually sanitizing the whitespace characters in the affected templates. This can be achieved by using a regular expression or a dedicated sanitization function to remove any whitespace characters that are not within the allowed character set. Here is an example of a workaround using a regular expression in JavaScript:
const sanitizedTemplate = template.replace(/[^\t\n\f\r\u0020\u2028\u2029]/g, '');
Conclusion
The golang package is vulnerable to an issue related to the improper sanitization of whitespace characters in JavaScript contexts. This can lead to potential security risks, such as code injection or cross-site scripting (XSS) attacks. It is crucial to update the golang package to the recommended versions or apply the provided workaround to mitigate the risk of exploitation. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for golang →
FAQ
This vulnerability can potentially allow an attacker to inject malicious code or execute arbitrary JavaScript in the context of the affected application. This can lead to various security risks, including data theft, unauthorized access, and cross-site scripting (XSS) attacks.
No, not all versions of the golang package are affected. Versions 0 and 1.20.0 and later are vulnerable, while versions 1.19.9 and 1.20.4 and later include the necessary fixes to address the vulnerability.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is important to promptly update the golang package to mitigate the risk of potential exploitation.
Yes, this vulnerability can be exploited remotely if the affected application accepts untrusted input in templates and executes them in a JavaScript context. An attacker can craft malicious input to inject arbitrary code or perform cross-site scripting (XSS) attacks.
Yes, this vulnerability has a CVSSv3 score of 9.8 (Critical), indicating its high severity and potential impact on the security of the affected application.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
