PT-2018-1096 · Go+2 · Go+2

Invizory · Published 2018-02-16 · Updated 2024-06-15 · CVE-2018-7187

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Go version 1.9.4

Description The issue arises from insufficient input validation in the "go get" implementation when the -insecure command-line option is used. Specifically, it only checks for "://" anywhere in the string, which allows remote attackers to execute arbitrary OS commands via a crafted web site. This can lead to remote code execution.

Recommendations For Go version 1.9.4, avoid using the -insecure command-line option with the "go get" command until a patch is available. As a temporary workaround, consider validating import paths manually to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

OS Command Injection

Weakness Enumeration

CWE-78

CWE-20

Related Identifiers

ALT-PU-2018-1655

BDU:2018-00493

CVE-2018-7187

DLA-1294-1

DSA-4379-1

DSA-4380-1

GO-2022-0203

MGASA-2018-0238

OPENSUSE-SU-2018:4302-1

OPENSUSE-SU-2018_1811-1

OPENSUSE-SU-2018_4306-1

OPENSUSE-SU-2024:10802-1

OPENSUSE-SU-2024:10812-1

SUSE-SU-2018:4297-1

Affected Products

Alt Linux

Go

Suse

References · 89

• 🔥 https://github.com/golang/go/issues/23867 · Exploit
• 🔥 https://github.com/KINGSABRI/CVE-in-Ruby/tree/master/CVE-2018-6574 · Exploit
• 🔥 https://github.com/neargle/Go-Get-RCE-CVE-2018-6574-POC · Exploit
• 🔥 https://github.com/neargle/CVE-2018-6574-POC · Exploit
• 🔥 https://github.com/alexzorin/poc-cve-2018-16875 · Exploit
• https://ubuntu.com/security/CVE-2018-7187 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-01889 · Security Note
• https://security.gentoo.org/glsa/201804-12 · Vendor Advisory
• https://debian.org/security/2019/dsa-4379 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/golang-1.8 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-4379-1 · Vendor Advisory
• https://debian.org/security/2019/dsa-4380 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10812-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0238.html · Security Note
• https://security-tracker.debian.org/tracker/DSA-4380-1 · Vendor Advisory