CVE-2023-45283: Insecure parsing of Windows paths in filepath package

Background

The filepath package is a part of the Go standard library and provides functions for manipulating file paths. It is commonly used in Go applications to handle file and directory paths in a platform-independent manner. The package includes functions for cleaning, joining, splitting, and evaluating file paths.

However, the filepath package in versions before 1.20.11 and 1.21.4 is vulnerable to an insecure parsing issue on Windows systems. This vulnerability allows an attacker to access arbitrary locations on the system by using paths with a ??\ prefix, which is equivalent to a \?\ prefix. These paths can bypass security restrictions and potentially lead to unauthorized access or other malicious activities.

Vulnerability Detail

The vulnerability arises from the filepath package's failure to recognize paths with a ??\ prefix as special on Windows systems. This prefix is used to denote Root Local Device paths, which can access arbitrary locations on the system. The Clean function in the package could convert a rooted path like \a..??\b into the root local device path ??\b. Similarly, the Join function could convert innocent path elements into the root local device path ??\b.

This insecure parsing of Windows paths can have severe consequences, including unauthorized access to sensitive files or directories, privilege escalation, and potential code execution. Attackers can exploit this vulnerability to bypass security measures and perform malicious actions on the affected system.

go get stdlib@vgo1.25.5

Workaround

If updating the Go standard library is not immediately feasible, a possible workaround is to manually sanitize and validate file paths before using them in the application. This can be done by checking for the presence of the ??\ prefix and rejecting or modifying the path accordingly.

Here is an example of a workaround function that checks for the ??\ prefix and replaces it with a safer alternative:

import "path/filepath"

func sanitizePath(path string) string {
  if filepath.HasPrefix(path, "\\??\\") {
    return ".\\??\\" + filepath.Clean(path[6:])
  }
  return path
}

Conclusion

The filepath package in versions before 1.20.11 and 1.21.4 of the Go standard library is vulnerable to an insecure parsing issue on Windows systems. This vulnerability allows attackers to access arbitrary locations on the system and can lead to unauthorized access, privilege escalation, and potential code execution. It is crucial for developers to update their Go installations and rebuild their applications with the patched version of the filepath package to mitigate this vulnerability.

For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for stdlib →

FAQ