CVE-2023-39318: HTML Injection in golang package
Summary
CVE-2023-39318: Improper handling of HTML-like comments in script contexts in html/template. Affects golang across 2 version ranges.
< 1.20.8
>= 1.21.0, < 1.21.1
Fixed in 1.20.8 or 1.21.1, depending on the release line you run. How to fix ↓
Also tracked for
- golang-1.15 · Debian:11
- stdlib · Go
The same CVE-2023-39318 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The golang package, developed by Bitnami, is a popular open-source programming language that provides a robust set of tools and libraries for building efficient and reliable applications. It is widely used for its simplicity, performance, and extensive standard library. However, a vulnerability has been discovered in the html/template package of golang, which can lead to HTML injection attacks.
Vulnerability Detail
The html/template package in golang fails to handle HTML-like "" comment tokens and hashbang "#!" comment tokens properly within <script> contexts. As a result, the template parser may misinterpret the content of <script> contexts, leading to improper escaping of actions. This vulnerability can be exploited to perform cross-site scripting (XSS) attacks, allowing an attacker to inject malicious code into web pages and potentially steal sensitive information or perform unauthorized actions.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.20.81.20.8 -
>= 1.21.0, < 1.21.11.21.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating the golang package is not immediately feasible, a temporary workaround can be implemented by manually sanitizing and escaping user-generated content within <script> contexts. This can be achieved by using appropriate HTML encoding functions or libraries to ensure that any potentially malicious code is rendered as plain text and not executed as JavaScript.
Conclusion
The golang package is susceptible to an HTML injection vulnerability in the html/template package. This can be exploited to perform cross-site scripting attacks, potentially compromising user data and application security. It is crucial to update to golang version 1.21.1 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for golang →
FAQ
This vulnerability allows an attacker to inject malicious code into web pages, potentially leading to the theft of sensitive information, unauthorized actions, or the compromise of user accounts.
At the time of this report, there are no known public exploits targeting this specific vulnerability. However, it is important to promptly apply the recommended fix to mitigate any potential risks.
No, not all versions of the golang package are affected. Versions 0 and 1.20.8 are vulnerable, while versions 1.21.0 and later have been fixed. It is crucial to update to version 1.21.1 or later to address this vulnerability.
Yes, this vulnerability can be exploited remotely. An attacker can inject malicious code into web pages that are rendered by applications using the vulnerable golang package, potentially affecting any user who visits those pages.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, allowing you to assess the security of your software without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
