PT-2022-9806 · Beego · Beego

Toptotuo · Published 2022-04-05 · Updated 2022-04-12 · CVE-2021-27116

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AC:L/AV:L/A:H/C:H/I:H/PR:L/S:U/UI:N

Name of the Vulnerable Software and Affected Versions beego versions through 2.0.2

Description An issue was discovered in the file profile.go, specifically in the MemProf function, which allows attackers to launch symlink attacks locally. This is due to the MemProf and GetCPUProfile functions not correctly checking whether the created file exists, enabling attackers to potentially escalate privileges.

Recommendations For beego versions through 2.0.2, consider disabling the MemProf and GetCPUProfile functions as a temporary workaround until a patch is available. Restrict access to the profile.go file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2021-27116

GHSA-FFJP-66MX-3QPJ

Affected Products

Beego

References · 7

• 🔥 https://github.com/beego/beego/issues/4484 · Exploit
• https://osv.dev/vulnerability/CVE-2021-27116 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27116 · Security Note
• https://osv.dev/vulnerability/GHSA-ffjp-66mx-3qpj · Vendor Advisory
• https://github.com/beego/beego · Note
• https://t.me/cibsecurity/40184 · Telegram Post
• https://t.me/cvenotify/28466 · Telegram Post