Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-27116

CVE-2021-27116: Privilege escalation in beego

7.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2021-27116
GHSA ID
GHSA-ffjp-66mx-3qpj
EPSS Score
0.37771%
CWE
CWE-59
Published
4/6/2022
Updated
1/27/2023
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/beego/beego/v2go>= 2.0.0, < 2.0.22.0.2
github.com/beego/beegogo< 2.0.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

  1. Multiple sources (CVE description, GHSA advisory, and GitHub issue #4484) explicitly name MemProf and GetCPUProfile as vulnerable functions.
  2. The vulnerability pattern matches CWE-59 (symlink attacks) which occurs when creating files without proper existence checks.
  3. The provided PoC demonstrates how writing to a symlinked file could overwrite protected files through these profiling functions.
  4. Both functions handle profile file creation in the vulnerable versions without adequate safeguards against existing symlinks.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*n issu* w*s *is*ov*r** in *il* pro*il*.*o. T** M*mPro* *n* **t*PUPro*il* *un*tions *o not *orr**tly ****k w**t**r t** *r**t** *il* *xists. *s * r*sult *tt**k*rs **n l*un** *tt**ks symlink *tt**ks lo**lly. *tt**k*rs **n us* t*is vuln*r**ility to *s**

Reasoning

*. Multipl* sour**s (*V* **s*ription, **S* **visory, *n* *it*u* issu* #****) *xpli*itly n*m* M*mPro* *n* **t*PUPro*il* *s vuln*r**l* *un*tions. *. T** vuln*r**ility p*tt*rn m*t***s *W*-** (symlink *tt**ks) w*i** o**urs w**n *r**tin* *il*s wit*out pro