CVE-2023-29400: golang - Templates containing actions in unquoted HTML attributes can result in attribute injection
Summary
CVE-2023-29400: Improper handling of empty HTML attributes in html/template. Affects golang across 2 version ranges.
< 1.19.9
>= 1.20.0, < 1.20.4
Fixed in 1.19.9 or 1.20.4, depending on the release line you run. How to fix ↓
Also tracked for
- golang-1.15 · Debian:11
- stdlib · Go
The same CVE-2023-29400 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The golang package, developed by Bitnami, is an open-source programming language that is widely used for building scalable and efficient applications. It provides a rich set of libraries and tools for various purposes, including web development. However, a vulnerability has been identified in golang that affects the handling of templates containing actions in unquoted HTML attributes. This vulnerability can lead to unexpected results when parsing empty input, potentially allowing the injection of arbitrary attributes into HTML tags.
Vulnerability Detail
The vulnerability in golang arises from the use of unquoted HTML attributes in templates. When these templates are executed with empty input, the resulting output may be parsed incorrectly due to HTML normalization rules. This can enable an attacker to inject arbitrary attributes into HTML tags, potentially leading to cross-site scripting (XSS) attacks or other security vulnerabilities. The impact of this vulnerability can vary depending on the specific usage of golang in an application, but it has the potential to compromise the integrity and security of the affected system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.19.91.19.9 -
>= 1.20.0, < 1.20.41.20.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating the golang package is not immediately feasible, a possible workaround is to ensure that all templates with actions in HTML attributes use quoted attributes instead of unquoted ones. By enclosing the attribute value in quotes, the HTML normalization rules are bypassed, preventing the vulnerability from being exploited. Here is an example of how to modify a template to use quoted attributes:
Before:
<div attr={{.}}></div>
After:
<div attr="{{.}}"></div>
Conclusion
The vulnerability in golang that allows injection of arbitrary attributes into HTML tags through unquoted HTML attributes in templates is a critical security issue. It is recommended to update the golang package to the fixed versions or apply the provided workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for golang →
FAQ
The impact of this vulnerability can vary depending on the specific usage of golang in an application. However, it has the potential to enable attackers to inject arbitrary attributes into HTML tags, which can lead to cross-site scripting (XSS) attacks or other security vulnerabilities.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this one.
At the time of this report, there are no known public exploits specifically targeting this vulnerability in golang. However, it is important to promptly apply the recommended fixes to mitigate the risk of potential exploitation.
Yes, a possible workaround is to modify the templates in your application to use quoted attributes instead of unquoted ones. This can prevent the vulnerability from being exploited. However, it is still strongly recommended to update the golang package to the fixed versions as soon as possible.
You can find more information about this vulnerability, including the technical details and the fixed versions of the golang package, in the vulnerability report available at https://github.com/bitnami/vulndb/tree/main/data/golang/BIT-golang-2023-29400.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
