by Kastro
Paper/Archive/CVE-2023-24531

CVE-2023-24531

Go toolchain cmd/go — Output of "go env" does not sanitize values in cmd/go

EPSS 0.8%CVSS 9.8
critical.is priorityof 100
41
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 57.9.579 × 2011.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executing its output as a shell script can cause various bad bahaviors, including executing arbitrary commands or inserting new environment variables. This issue is relatively minor because, in general, if an attacker can set arbitrary environment variables on a system, they have better attack vectors than making "go env" print them out.

Affected

ProductAffectedFixed inSource
cmd/go< 1.21.0-01.21.0-0CNA
cmd\/go< 1.21.0-01.21.0-0CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgo.dev/cl/488375refgo.dev/cl/493535refgo.dev/issue/58508refgroups.google.com/g/golang-dev/c/ixHOFpSbajE/m/8EjlbKVWAwAJrefpkg.go.dev/vuln/GO-2024-2962refsecurity.netapp.com/advisory/ntap-20250328-0005