CVE-2023-24531 Output of "go env" does not sanitize values in cmd/go
The Go toolchain's 'go env' command fails to sanitize output, allowing arbitrary command execution if the output is executed as a shell script.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-24531?
CVE-2023-24531 is a critical command injection vulnerability in cmd/go, published on 2 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executing its output as a shell script can cause various bad bahaviors, including executing arbitrary commands or inserting new environment variables. This issue is relatively minor because, in general, if an attacker can set arbitrary environment variables on a system, they have better attack vectors than making "go env" print them out.
Which versions are affected by CVE-2023-24531?
2 open source packages ship an affected version, including golang and toolchain.
| Package | Affected | Fixed in |
|---|---|---|
golang Bitnami | All versions | 1.21.0-0 |
toolchain Go | All versions | 1.21.0-0 |
How do I fix CVE-2023-24531?
Upgrade golang to 1.21.0-0 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2023-24531 being exploited?
There is no known exploitation of CVE-2023-24531 in the wild and no public exploit code.
Sources
Also known as AZL-43104, AZL-43110, AZL-52719, AZL-79036, AZL-98667, BIT-golang-2023-24531 and 7 more.