CVE-2022-41720 Restricted file access on Windows in os and net/http
Attackers can access restricted Windows device files or escape drive roots via crafted paths in Go's os.DirFS and http.Dir functions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-41720?
CVE-2022-41720 is a high-severity path traversal vulnerability in Golang Go, published on 7 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
On Windows, restricted files can be accessed via os.DirFS and http.Dir. The os.DirFS function and http.Dir type provide access to a tree of files rooted at a given directory. These functions permit access to Windows device files under that root. For example, os.DirFS("C:/tmp").Open("COM1") opens the COM1 device. Both os.DirFS and http.Dir only provide read-only filesystem access. In addition, on Windows, an os.DirFS for the directory (the root of the current drive) can permit a maliciously crafted path to escape from the drive and access any path on the system. With fix applied, the behavior of os.DirFS("") has changed. Previously, an empty root was treated equivalently to "/", so os.DirFS("").Open("tmp") would open the path "/tmp". This now returns an error.
Weakness: CWE-22
Which versions are affected by CVE-2022-41720?
2 open source packages ship an affected version, including golang and stdlib. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
golang Bitnami | All versions | 1.18.9, 1.19.4 |
stdlib Go | All versions | 1.18.9, 1.19.4 |
Products include Golang Go.
How do I fix CVE-2022-41720?
Upgrade golang to a fixed version for your release line: 1.18.9 or 1.19.4.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-41720 being exploited?
There is no known exploitation of CVE-2022-41720 in the wild and no public exploit code.
Other vulnerabilities in Golang Go
- CVE-2020-0601 Microsoft Windows CryptoAPI Spoofing
- CVE-2026-27143 Missing bound checks can lead to memory corruption in safe Go in cmd/compile
- CVE-2024-24790 Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip
- CVE-2023-39320 Arbitrary code execution via go.mod toolchain directive in cmd/go
- CVE-2023-24540 Improper handling of JavaScript whitespace in html/template
Sources
Also known as AZL-79038, AZL-98604, BIT-golang-2022-41720, DEBIAN-CVE-2022-41720, GHSA-cvf9-g74c-vv79, GO-2022-1143 and 1 more.