PT-2022-9807 · Beego · Beego

Toptotuo · Published 2022-04-05 · Updated 2022-04-12 · CVE-2021-27117

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions beego versions through 2.0.2

Description An issue was discovered in the file profile.go in the function GetCPUProfile, allowing attackers to launch symlink attacks locally. The issue affects beego, an open-source, high-performance web framework for the Go programming language.

Recommendations For beego versions through 2.0.2, consider disabling the GetCPUProfile function in the profile.go file as a temporary workaround to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2021-27117

GHSA-2V6V-Q994-XVXX

Affected Products

Beego

References · 7

• 🔥 https://github.com/beego/beego/issues/4484 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-27117 · Security Note
• https://osv.dev/vulnerability/GHSA-2v6v-q994-xvxx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-27117 · Vendor Advisory
• https://github.com/beego/beego · Note
• https://t.me/cibsecurity/40186 · Telegram Post
• https://t.me/cvenotify/28465 · Telegram Post