CVE-2022-41720: Restricted file access on Windows in os and net/http
Golang Go could allow a remote attacker to obtain sensitive information, caused byimproper access control by the os.DirFS function and http.Dir type. By sending a specially-crafted request, an attacker could exploit this vulnerability to access any path on the system, and use this information to launch further attacks against the affected system.
Other sources
On Windows, restricted files can be accessed via os.DirFS and http.Dir. The os.DirFS function and http.Dir type provide access to a tree of files rooted at a given directory. These functions permit access to Windows device files under that root. For example, os.DirFS("C:/tmp").Open("COM1") opens the COM1 device. Both os.DirFS and http.Dir only provide read-only filesystem access. In addition, on Windows, an os.DirFS for the directory (the root of the current drive) can permit a maliciously crafted path to escape from the drive and access any path on the system. With fix applied, the behavior of os.DirFS("") has changed. Previously, an empty root was treated equivalently to "/", so os.DirFS("").Open("tmp") would open the path "/tmp". This now returns an error.
Restricted file access on Windows in os and net/http
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the Go fix that changes os.DirFS("") behavior and makes os.DirFS and http.Dir return an error for paths that would otherwise access restricted Windows files/device paths or escape the intended root.
Go standard library (os.DirFS / net/http.Dir) Behavior for os.DirFS("") root path handling = Changed to return an error instead of treating empty root as "/"
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-41720.
What is the severity of CVE-2022-41720?
The severity of CVE-2022-41720 is high with a CVSS score of 7.5.
How does CVE-2022-41720 impact Golang Go versions?
CVE-2022-41720 impacts Golang Go versions 1.18.9 up to, but excluding, 1.19.4.
How does CVE-2022-41720 impact Microsoft Windows?
CVE-2022-41720 does not directly impact Microsoft Windows.
How can I mitigate CVE-2022-41720?
To mitigate CVE-2022-41720, it is recommended to upgrade Golang Go to a version above 1.19.4.