CVE-2023-45283 Insecure parsing of Windows paths with a \??\ prefix in path/filepath
The Go filepath package mishandles Windows paths with a \??\ prefix, allowing attackers to bypass path restrictions and access arbitrary system locations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-45283?
CVE-2023-45283 is a high-severity path traversal vulnerability in Golang Go, published on 9 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The filepath package does not recognize paths with a \??\ prefix as special. On Windows, a path beginning with \??\ is a Root Local Device path equivalent to a path beginning with \\?\. Paths with a \??\ prefix may be used to access arbitrary locations on the system. For example, the path \??\c:\x is equivalent to the more common path c:\x. Before fix, Clean could convert a rooted path such as \a\..\??\b into the root local device path \??\b. Clean will now convert this to .\??\b. Similarly, Join(\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \??\b. Join will now convert this to \.\??\b. In addition, with fix, IsAbs now correctly reports paths beginning with \??\ as absolute, and VolumeName correctly reports the \??\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \?, resulting in filepath.Clean(\?\c:) returning \?\c: rather than \?\c:\ (among other effects). The previous behavior has been restored.
Weakness: CWE-22
Which versions are affected by CVE-2023-45283?
3 open source packages ship an affected version, including golang and stdlib. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
golang Bitnami | All versions | 1.20.11, 1.21.4 |
stdlib Go | All versions | 1.20.11, 1.21.4 |
stdlib Go | From 1.20.11 | 1.20.12, 1.21.5 |
Linux distribution packages (2)
go1.20 openSUSE:Tumbleweed | All versions | 1.20.11-1.1 |
go1.21 openSUSE:Tumbleweed | All versions | 1.21.4-1.1 |
Products include Golang Go.
How do I fix CVE-2023-45283?
Upgrade golang to a fixed version for your release line: 1.20.11 or 1.21.4.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-45283 being exploited?
There is no known exploitation of CVE-2023-45283 in the wild and no public exploit code.
Other vulnerabilities in Golang Go
- CVE-2020-0601 Microsoft Windows CryptoAPI Spoofing
- CVE-2026-27143 Missing bound checks can lead to memory corruption in safe Go in cmd/compile
- CVE-2024-24790 Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip
- CVE-2023-39320 Arbitrary code execution via go.mod toolchain directive in cmd/go
- CVE-2023-24540 Improper handling of JavaScript whitespace in html/template
Sources
Also known as AZL-31897, AZL-37397, AZL-37444, AZL-79034, AZL-98664, BIT-golang-2023-45283 and 7 more.