CVE-2020-24553: Cross-Site Scripting Vulnerability in net/http/cgi and net/http/fcgi Packages
Summary
GO-2021-0143: When a Handler does not explicitly set the Content-Type header, the net/http/cgi and net/http/fcgi packages default to "text/html", which can cause a Cross-Site Scripting vulnerability if an attacker can control any part... Affects net/http/cgi across 2 version ranges.
< 1.14.8
>= 1.15.0, < 1.15.1
Fixed in 1.14.8 or 1.15.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net/http/cgi and net/http/fcgi packages in Go provide functionality for running CGI and FastCGI programs. These packages are commonly used in web applications to handle HTTP requests and generate responses. The vulnerability in these packages allows for a Cross-Site Scripting (XSS) attack if the Content-Type header is not explicitly set by the Handler. This can occur when an attacker has control over any part of the response content.
Vulnerability Detail
The vulnerability arises from the default behavior of the net/http/cgi and net/http/fcgi packages, which set the Content-Type header to "text/html" when it is not explicitly specified. This can lead to an XSS vulnerability if an attacker can manipulate the response content. By injecting malicious scripts or code into the response, an attacker can execute arbitrary code in the context of the victim's browser. This can result in various consequences, such as stealing sensitive information, session hijacking, or defacement of the affected web application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.14.81.14.8go get net/http/cgi@v1.14.8 -
>= 1.15.0, < 1.15.11.15.1go get net/http/cgi@v1.15.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, developers can manually set the Content-Type header in their Handler code. For example, if the response content is plain text, the Content-Type header can be set to "text/plain". This ensures that the browser interprets the response correctly and reduces the risk of XSS attacks. Here is an example of how to set the Content-Type header in Go:
func handler(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Content-Type", "text/plain")
// Rest of the handler code
}
Conclusion
The Cross-Site Scripting vulnerability in the net/http/cgi and net/http/fcgi packages can have serious consequences, including the execution of arbitrary code in the victim's browser. To mitigate this risk, developers should ensure that the Content-Type header is explicitly set in their Handler code. Updating to the latest patched versions of the affected packages is also recommended. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for net/http/cgi →
FAQ
The vulnerability allows for Cross-Site Scripting (XSS) attacks, which can lead to the execution of arbitrary code in the victim's browser. This can result in various consequences, including data theft, session hijacking, and defacement of the affected web application.
The vulnerability affects versions 0.0.0 to 1.14.8 and 1.15.0 to 1.15.1 of the net/http/cgi and net/http/fcgi packages.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is important to promptly address and fix the vulnerability to prevent potential attacks.
Yes, the vulnerability has been fixed in versions 1.14.8 and 1.15.1 of the net/http/cgi and net/http/fcgi packages. It is recommended to update to the latest patched version to mitigate the risk.
You can find more information about this vulnerability, including the technical details and affected package versions, in the vulnerability report available at https://pkg.go.dev/vuln/GO-2021-0143.
