CVE-2022-30580: Code injection in os/exec package in Go
Summary
CVE-2022-30580: golang: os/exec: Code injection in Cmd.Start. Affects stdlib versions < 1.17.11, 1.18.3. Fixed in 1.17.11, 1.18.3. How to fix ↓
Also tracked for
The same CVE-2022-30580 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stdlib package in Go is a collection of standard libraries that provide essential functionality for Go programs. The os/exec package within stdlib allows the execution of external commands. However, versions before Go 1.17.11 and Go 1.18.3 are vulnerable to code injection. This vulnerability enables the execution of any binaries in the working directory named either "..com" or "..exe" when certain functions like Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput are called without setting the Cmd.Path.
Vulnerability Detail
The vulnerability (CVE-2022-30580) in the os/exec package of Go allows an attacker to inject arbitrary code during the execution of external commands. By exploiting this vulnerability, an attacker can execute any binaries in the working directory named "..com" or "..exe". This can lead to unauthorized code execution and potential compromise of the system. The vulnerability has a CVSS score of 7.8, indicating a high severity level.
How To Fix
Minimum fixed version
1.17.11, 1.18.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, developers can explicitly set the Cmd.Path to the absolute path of the desired executable instead of relying on the working directory. This ensures that only the intended executable is executed and mitigates the risk of code injection.
Conclusion
The code injection vulnerability in the os/exec package of Go (CVE-2022-30580) poses a significant risk to systems running affected versions. It is crucial to update to Go 1.17.11 or 1.18.3 to mitigate this vulnerability. Developers should also consider implementing the recommended workaround of explicitly setting the Cmd.Path to minimize the risk of code injection. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
This vulnerability allows an attacker to execute arbitrary code, potentially leading to unauthorized access, data breaches, or system compromise.
Versions before Go 1.17.11 and Go 1.18.3 are affected by this vulnerability.
At the time of this report, there are no known public exploits targeting this vulnerability.
Yes, the CVSS score for this vulnerability is 7.8, indicating a high severity level.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) to the playground, and it will provide real-time monitoring and alerts for open-source vulnerabilities, including this one.
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
