CVE-2023-45283: Vulnerability in golang package
Summary
CVE-2023-45283: Insecure parsing of Windows paths with a \??\ prefix in path/filepath. Affects golang across 2 version ranges.
< 1.20.11
>= 1.21.0-0, < 1.21.4
Fixed in 1.20.11 or 1.21.4, depending on the release line you run. How to fix ↓
Also tracked for
- golang-1.15 · Debian:11
- stdlib · Go
The same CVE-2023-45283 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The golang package is a popular open-source programming language that is widely used for developing efficient and reliable software applications. It provides a rich set of libraries and tools for various purposes, including file handling and path manipulation. However, a vulnerability has been discovered in the filepath package of golang, which can lead to potential security risks on Windows systems.
Vulnerability Detail
The filepath package in golang does not properly handle paths with a ??\ prefix on Windows systems. This prefix is used to represent Root Local Device paths, which can access arbitrary locations on the system. The vulnerability allows an attacker to manipulate file paths and potentially gain unauthorized access to sensitive files or execute malicious code. The Clean and Join functions in the filepath package are affected by this vulnerability. Additionally, the behavior of IsAbs and VolumeName functions has been impacted by recent updates to Go versions 1.20.11 and 1.21.4.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.20.111.20.11 -
>= 1.21.0-0, < 1.21.41.21.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating the golang package is not immediately feasible, a workaround can be implemented by manually modifying the affected functions in the filepath package. The Clean function should be modified to convert rooted paths with the ??\ prefix to .??, and the Join function should convert the path elements to .??. However, it is strongly recommended to apply the official fix by updating the package as soon as possible.
Conclusion
The golang package is susceptible to a vulnerability in the filepath package, which can lead to unauthorized access to files or execution of malicious code on Windows systems. It is crucial to update the package to version 1.20.11 or higher to fix this vulnerability. Developers should also review their code and ensure secure path manipulation practices. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for golang →
FAQ
This vulnerability allows an attacker to manipulate file paths and potentially gain unauthorized access to sensitive files or execute malicious code on Windows systems.
Versions prior to 1.20.11 and versions 1.21.0-0 to 1.21.4 of the golang package are affected by this vulnerability.
No, this vulnerability specifically affects Windows systems.
At the time of this report, there are no known public exploits for this vulnerability. However, it is important to apply the fix as soon as possible to mitigate any potential risks.
In addition to updating the golang package, it is recommended to follow secure coding practices and avoid using insecure path manipulation techniques in your code. Always validate and sanitize user input to prevent any potential path traversal attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
