CVE-2023-39319: Improper Handling of Special Tags in golang/stdlib
Summary
CVE-2023-39319: The html/template package does not apply the proper rules for handling occurrences of ". Affects golang-1.15 versions < d5b851804329aa547dafa278a0c35dd62298d651. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The golang/stdlib package is a standard library in the Go programming language. It provides a wide range of functionalities for developing Go applications. This vulnerability affects version 1.18.2 of the package.
Vulnerability Detail
The html/template package within golang/stdlib does not properly handle occurrences of "<script", "<!--", and "</script" within JavaScript literals in <script> contexts. This flaw can cause the template parser to mistakenly consider script contexts as terminated early, leading to improper escaping of actions. Exploiting this vulnerability could enable an attacker to perform cross-site scripting (XSS) attacks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
The golang/stdlib package version 1.18.2 is vulnerable to an improper handling of special tags within script contexts, which can lead to cross-site scripting attacks. To mitigate this vulnerability, it is crucial to upgrade to version 1.20.8 or 1.21.1. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for golang-1.15 →
FAQ
This vulnerability allows an attacker to execute arbitrary JavaScript code in the context of a victim's browser, potentially leading to the theft of sensitive information or unauthorized actions on the affected web application.
No, only version 1.18.2 of the golang/stdlib package is affected by this vulnerability. Upgrading to version 1.20.8 or 1.21.1 resolves the issue.
There are no known public exploits available for this vulnerability at the moment.
Yes, it is recommended to update all applications that utilize the golang/stdlib package to the fixed versions (1.20.8 or 1.21.1) to ensure they are not vulnerable to this issue.
You can find more information about this vulnerability in the National Vulnerability Database (NVD) entry: https://nvd.nist.gov/vuln/detail/CVE-2023-39319.
Related vulnerabilities
Recent vulnerabilities recorded for golang-1.15.
