CVE-2018-16873 Command injection in golang
Attackers can execute arbitrary commands on the developer's machine by tricking the Go toolchain into treating a malicious directory as a Git repository.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2018-16873?
CVE-2018-16873 is a high-severity command injection vulnerability in Debian Debian Linux, published on 14 Dec 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, or a package that imports it directly or indirectly. Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). Using custom domains, it's possible to arrange things so that a Git repository is cloned to a folder named ".git" by using a vanity import path that ends with "/.git". If the Git repository root contains a "HEAD" file, a "config" file, an "objects" directory, a "refs" directory, with some work to ensure the proper ordering of operations, "go get -u" can be tricked into considering the parent directory as a repository root, and running Git commands on it. That will use the "config" file in the original Git repository root for its configuration, and if that config file contains malicious commands, they will execute on the system running "go get -u".
Weakness: CWE-20
Which versions are affected by CVE-2018-16873?
1 open source package ship an affected version, including toolchain. It affects 5 products.
| Package | Affected | Fixed in |
|---|---|---|
toolchain Go | All versions | 1.10.6, 1.11.3 |
Products include Debian Debian Linux, Golang Go, Opensuse Backports Sle, Opensuse Leap, Suse Linux Enterprise Server.
How do I fix CVE-2018-16873?
Upgrade toolchain to a fixed version for your release line: 1.10.6 or 1.11.3.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2018-16873 being exploited?
There is no known exploitation of CVE-2018-16873 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as GHSA-q6pp-3q54-qw37, GO-2022-0189, UBUNTU-CVE-2018-16873.