Critical Golang flaws

guest · Dec 16, 2020

Critical Golang XML parser bugs can cause SAML authentication bypass
December 14, 2020
https://www.bleepingcomputer.com/ne...er-bugs-can-cause-saml-authentication-bypass/

This week, Mattermost, in coordination with Golang has disclosed 3 critical vulnerabilities within Go language's XML parser.

If exploited, these vulnerabilities, also impacting multiple Go-based SAML implementations, can lead to a complete bypass of SAML authentication which powers prominent web applications today.
XML parser doesn't guarantee integrity
The XML round-trip vulnerabilities listed below lurk in Golang's XML language parser encoding/xml which doesn't return reliable results when encoding and decoding XML input.
Click to expand...

"As evident from the titles, the vulnerabilities are closely related. The core issue is the same in all three: maliciously crafted XML markup mutates during round-trips through Go’s decoder and encoder implementations," said Juho Nurminen, Product Security Engineer at Mattermost.
Click to expand...

Mattermost: Coordinated disclosure of XML round-trip vulnerabilities in Go’s standard library

guest · Aug 2, 2022

Go-Based Apps Vulnerable to Attacks Due to URL Parsing Issue
August 2, 2022

Go, or Golang, is an open source programming language designed for building reliable and efficient software at scale. Supported by Google, Go is leveraged by some of the world’s largest companies and it’s often used to develop cloud-native apps, including for Kubernetes.

Oxeye researchers have conducted an analysis of Go-based cloud-native applications and discovered an edge case that could have serious implications.
Click to expand...

The issue, which they have dubbed ParseThru, is related to unsafe URL parsing. Until version 1.17, Go considered semicolons in the query part of a URL as a valid delimiter. Starting with this version, an error is returned if the URL query contains a semicolon.

Oxeye researchers discovered that if a user-facing application is running on Go 1.17 or later and the associated backend service is running on an earlier version of Go, an attacker can smuggle requests with query parameters that would normally be rejected.
Click to expand...

Application developers are advised to consider using alternative methods for parsing query strings or ensure that queries containing a semicolon are rejected in order to prevent abuse.
Click to expand...

Log in or Sign up

Critical Golang flaws

guest Guest

guest Guest

Log in or Sign up

Critical Golang flaws

guest Guest

guest Guest

Useful Searches