CVE-2023-29406: stdlib - insufficient sanitization of Host header
Summary
CVE-2023-29406: The HTTP/1 client does not fully validate the contents of the Host header. Affects golang-1.15 versions < e58941fc25771784319ebd0178e566ecf7d3d8c1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stdlib package is a part of the Go programming language standard library. It provides a collection of commonly used functions, types, and constants that are essential for Go developers. The package is widely used in various Go applications and is critical for the proper functioning of the language. However, a vulnerability has been discovered in the net/http module of stdlib, which can allow an attacker to inject additional headers or entire requests by exploiting insufficient sanitization of the Host header.
Vulnerability Detail
The vulnerability in the stdlib package arises from the HTTP/1 client's failure to fully validate the contents of the Host header. An attacker can craft a malicious Host header to inject unauthorized headers or even complete requests. This can lead to various security risks, such as unauthorized access, data leakage, or remote code execution. The fix for this vulnerability ensures that the HTTP/1 client refuses to send requests containing an invalid Request.Host or Request.URL.Host value.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, developers can manually sanitize the Host header before processing it. This can be done by validating the Host header against a whitelist of allowed values or by using a regular expression to ensure it matches the expected format. Here's an example of how to sanitize the Host header in Go:
import (
"net/http"
"regexp"
)
func sanitizeHostHeader(r *http.Request) {
validHostRegex := regexp.MustCompile(`^[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$`)
if !validHostRegex.MatchString(r.Host) {
r.Host = ""
}
}
Conclusion
The stdlib package in Go is vulnerable to an insufficient sanitization of the Host header, which can allow attackers to inject unauthorized headers or complete requests. To mitigate this vulnerability, it is crucial to update the stdlib package to version 1.19.11 or 1.20.6. Additionally, developers can manually sanitize the Host header as a temporary workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for golang-1.15 →
FAQ
The vulnerability allows an attacker to inject unauthorized headers or complete requests, potentially leading to unauthorized access, data leakage, or remote code execution.
The vulnerability affects stdlib package version 1.18.2. Prior versions may also be affected.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is advisable to apply the recommended fixes to mitigate any potential risks.
Yes, the CVSS score for this vulnerability is 6.5, indicating a medium severity level.
You can find more information about this vulnerability, including technical details and remediation steps, in the official CVE report: https://nvd.nist.gov/vuln/detail/CVE-2023-29406
Related vulnerabilities
Recent vulnerabilities recorded for golang-1.15.
