PT-2021-9104 · Goa · Goa

Christi3K · Published 2021-04-14 · Updated 2023-06-08 · CVE-2019-25073

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions github.com/goadesign/goa versions prior to 3.0.9 github.com/goadesign/goa versions prior to 2.0.10 github.com/goadesign/goa versions prior to 1.4.3

Description The issue is related to improper path sanitization, allowing remote attackers to read files outside of the intended directory due to insufficient sanitization of user input. This enables directory traversal, permitting an attacker to access files that the server has permission to read, outside of the target directory.

Recommendations For versions prior to 3.0.9, update to version 3.0.9 or later. For versions prior to 2.0.10, update to version 2.0.10 or later. For versions prior to 1.4.3, update to version 1.4.3 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2019-25073

GHSA-FJGQ-224F-FQ37

GO-2020-0032

Affected Products

Goa

References · 10

• 🔥 https://github.com/goadesign/goa/pull/2388 · Exploit
• https://github.com/goadesign/goa/commit/70b5a199d0f813d74423993832c424e1fc73fb39 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-25073 · Security Note
• https://osv.dev/vulnerability/CVE-2019-25073 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2020-0032 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fjgq-224f-fq37 · Vendor Advisory
• https://github.com/goadesign/goa · Note
• https://t.me/cvenotify/40836 · Telegram Post
• https://pkg.go.dev/vuln/GO-2020-0032 · Note
• https://t.me/cvenotify/41404 · Telegram Post