CVE-2023-24531: Output of "go env" does not sanitize values in cmd/go
Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executing its output as a shell script can cause various bad bahaviors, including executing arbitrary commands or inserting new environment variables. This issue is relatively minor because, in general, if an attacker can set arbitrary environment variables on a system, they have better attack vectors than making "go env" print them out.
Other sources
Output of "go env" does not sanitize values in cmd/go
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.21.0-1
Event History
Frequently Asked Questions
What is the severity of CVE-2023-24531?
CVE-2023-24531 has been classified as a high severity vulnerability due to the risk of executing arbitrary commands.
How do I fix CVE-2023-24531?
To fix CVE-2023-24531, it is recommended to upgrade to a fixed version of the golang package beyond the affected versions.
What are the potential impacts of CVE-2023-24531?
The potential impacts of CVE-2023-24531 include the execution of arbitrary commands and unintended alterations to the environment variables.
Which versions of Go are affected by CVE-2023-24531?
Versions golang-1.15 up to 1.15.15-1~deb11u4 and golang-1.19 up to 1.19.8-2 are affected by CVE-2023-24531.
How does CVE-2023-24531 exploit go env output?
CVE-2023-24531 exploits the go env output by not sanitizing values, allowing a shell script formed from its output to execute malicious commands.