Vulnerability in golang package: BIT-golang-2024-24785
Summary
CVE-2024-24785: Errors returned from JSON marshaling may break template escaping in html/template. Affects golang across 2 version ranges.
< 1.21.8
>= 1.22.0-0, < 1.22.1
Fixed in 1.21.8 or 1.22.1, depending on the release line you run. How to fix ↓
Also tracked for
- golang-1.15 · Debian:11
- stdlib · Go
- stdlib · Go
- stdlib · Go
The same CVE-2024-24785 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The golang package, developed by Bitnami, is a popular open-source programming language that provides a robust set of tools and libraries for building scalable and efficient applications. It is widely used for its simplicity, performance, and extensive standard library. However, a vulnerability has been identified in the package that affects its interaction with the html/template package, potentially allowing for unexpected content injection into templates.
Vulnerability Detail
The vulnerability (BIT-golang-2024-24785) arises when errors returned from MarshalJSON methods in the golang package contain user-controlled data. This can be exploited to bypass the contextual auto-escaping behavior of the html/template package. As a result, an attacker could inject malicious content into templates, leading to various security risks such as cross-site scripting (XSS) attacks and data manipulation. It is crucial to address this vulnerability promptly to prevent potential exploitation.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.21.81.21.8 -
>= 1.22.0-0, < 1.22.11.22.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating the golang package is not immediately feasible, a temporary workaround can be implemented by manually validating and sanitizing any user-controlled data before passing it to the MarshalJSON methods. This can help prevent the injection of unexpected content into templates. Here's an example of how to sanitize user-controlled data in a JSON object:
import (
"encoding/json"
"html"
)
// ... code snippet ...
func (obj MyObject) MarshalJSON() ([]byte, error) {
// Sanitize user-controlled data
obj.UserData = html.EscapeString(obj.UserData)
// Marshal the sanitized object
return json.Marshal(obj)
}
Conclusion
The vulnerability in the golang package (BIT-golang-2024-24785) exposes applications to the risk of content injection and potential security breaches. It is crucial to update the package to version 1.22.1 or later to mitigate the vulnerability. If immediate updating is not possible, implementing a temporary workaround by validating and sanitizing user-controlled data can help reduce the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for golang →
FAQ
The vulnerability allows attackers to inject unexpected content into templates, potentially leading to cross-site scripting (XSS) attacks and data manipulation. It is crucial to address this vulnerability to prevent unauthorized access and protect the integrity of the application.
The vulnerability affects versions 0.0.0, 1.22.0-0, and any versions prior to 1.22.1. It is recommended to update to version 1.22.1 or later to mitigate the vulnerability.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is important to address the vulnerability promptly to prevent potential exploitation.
Yes, this vulnerability can be exploited remotely if the affected application allows user-controlled data to be passed to the MarshalJSON methods without proper validation and sanitization.
You can use Vulert, a vulnerability monitoring tool, to check if your application is affected by this vulnerability. Vulert analyzes your package manifest file (e.g., package-lock.json) and provides real-time alerts for open-source vulnerabilities. Visit Vulert Scanner to access the Vulert playground and check the vulnerability status of your application.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
