Improper validation of the filepath argument in tgogenerator.cc:formatgooutput() of the Apache Thrift Go client library can allow an attacker to execute arbitrary commands.

The filepath parameter is derived from the service name. If an attacker can provide a service name to a framework invoking Thrift, the attacker could craft the name in a way leading to arbitrary commands being executed.

This affects versions before Apache Thrift 0.10.0.

Upstream Advisory:

http://mail-archives.apache.org/modmbox/thrift-user/201701.mbox/%3CCANyrgvc3W%3DMJ9S-hMZecPNzxkyfgNmuSgVfW2hdDSz5ke%2BOPhQ%40mail.gmail.com%3E

Upstream Issue:

https://issues.apache.org/jira/browse/THRIFT-3893

Upstream Commit:

https://github.com/apache/thrift/commit/2007783e874d524a46b818598a45078448ecc53e

A flaw was found in Apache Thrift versions 0.9.3 to 0.12.0. A server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid input data.

References:

https://seclists.org/oss-sec/2019/q4/29

Apache Thrift is vulnerable to a denial of service, caused by improper input validation. By sending specially-crafted messages, a remote attacker could exploit this vulnerability to cause a large memory allocation.