CVE-2024-24785: Vulnerability in stdlib package - html/template
Summary
CVE-2024-24785: If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected... Affects golang-1.15 versions 1.15.15-1 – 1.15.9-6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stdlib package is a part of the Go programming language standard library. It provides a collection of essential functions, data types, and utilities for Go programs. The html/template package within stdlib is used for generating HTML templates. It offers automatic contextual escaping to prevent code injection and cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability (CVE-2024-24785) in the html/template package arises when errors returned from MarshalJSON methods contain user-controlled data. This can lead to a break in the contextual auto-escaping behavior of the package, allowing unexpected content to be injected into templates. Attackers could exploit this vulnerability to execute arbitrary code, inject malicious content, or bypass security measures.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
The vulnerability in the stdlib package's html/template module can allow for the injection of unexpected content into templates, potentially leading to various security risks. It is crucial to update to the fixed versions (1.21.8 or 1.22.1) and review code handling user-controlled data to prevent exploitation. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for golang-1.15 →
FAQ
The vulnerability allows attackers to inject unexpected content into templates, potentially leading to code execution, content manipulation, or bypassing security measures.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
At the time of this report, no known exploits have been reported for this vulnerability. However, it is crucial to update the stdlib package to the fixed versions to mitigate any potential risks.
You can find more information about this vulnerability in the National Vulnerability Database (NVD) entry: https://nvd.nist.gov/vuln/detail/CVE-2024-24785
The fixed versions of the stdlib package (1.21.8 and 1.22.1) can be obtained from the official Go website or package manager.
Related vulnerabilities
Recent vulnerabilities recorded for golang-1.15.
