CVE-2023-28105 Go-huge-util vulnerable to path traversal when unzipping files
Attackers can exploit path traversal in the Go-huge-util library to write files outside the intended directory when unzipping malicious archives.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-28105?
CVE-2023-28105 is a high-severity path traversal vulnerability in dablelv go-huge-util, published on 16 Mar 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
go-used-util has commonly used utility functions for Go. Versions prior to 0.0.34 have a ZipSlip issue when using fsutil package to unzip files. When users use `zip.Unzip` to unzip zip files from a malicious attacker, they may be vulnerable to path traversal. The issue has been fixed in version 0.0.34. There are no known workarounds.
Weakness: CWE-22
Which versions are affected by CVE-2023-28105?
3 open source packages ship an affected version, including github.com/dablelv/go-huge-util. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/dablelv/go-huge-util Go | All versions | 0.0.34 |
github.com/dablelv/go-huge-util Go | All versions | 0.0.34 |
github.com/dablelv/go-huge-util Go | All versions | 0.0.34 |
Products include Go-Huge-Util Project Go-Huge-Util.
How do I fix CVE-2023-28105?
Upgrade github.com/dablelv/go-huge-util to 0.0.34 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-28105 being exploited?
There is no known exploitation of CVE-2023-28105 in the wild and no public exploit code.
Sources
Also known as GHSA-5g39-ppwg-6xx8, GO-2023-1640.