Path Traversal in Golang Go
CVE-2022-41720
On Windows, restricted files can be accessed via os.DirFS and http.Dir. The os.DirFS function and http.Dir type provide access to a tree of files rooted at a given directory. These functions permit access to Windows device files under that root. For example, os.DirFS("C:/tmp").Open("COM1") opens the COM1 device. Both os.DirFS and http.Dir only provide read-only filesystem access. In addition, on Windows, an os.DirFS for the directory (the root of the current drive) can permit a maliciously crafted path to escape from the drive and access any path on the system. With fix applied, the behavior of os.DirFS("") has changed. Previously, an empty root was treated equivalently to "/", so os.DirFS("").Open("tmp") would open the path "/tmp". This now returns an error.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.012 (67.9th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 68th percentile — 67.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.012 · newest: 0.012 · change: +0.000
Affected products
- Golang Go
- Go Standard Library Net/http — versions 0, 1.19.0-0
- Go Standard Library OS — versions 0, 1.19.0-0
- Microsoft Windows
Weakness classification (CWE)
Public proof-of-concept exploits
References
- go.dev/issue/56694 (Issue Tracking, Vendor Advisory)
- go.dev/cl/455716 (Patch, Vendor Advisory)
- groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ (Patch, Third Party Advisory, Release Notes)
- pkg.go.dev/vuln/GO-2022-1143 (Patch, Vendor Advisory)
Frequently asked questions
- What is CVE-2022-41720?
- CVE-2022-41720 is a high-severity vulnerability in Golang Go, classified under Path Traversal. CVSS score: 7.5/10. Published 2022-12-07.
- How severe is CVE-2022-41720?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2022-41720 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.