Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-31836

CVE-2022-31836: Path Traversal in Beego

9.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-31836
GHSA ID
GHSA-95f9-94vc-665h
EPSS Score
0.62084%
CWE
CWE-22
Published
7/6/2022
Updated
8/28/2023
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/beego/beegogo< 1.12.111.12.11
github.com/beego/beego/v2go>= 2.0.0, < 2.0.42.0.4

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the Tree.Match function's handling of wildcard values in routing patterns. Multiple sources (CVE description, GitHub issue #4961, and commit ea5ae58) directly implicate this function. The fix involved adding path.Clean() to sanitize inputs, confirming the vulnerability existed in the path joining logic within Match. The affected file path is explicitly referenced in issue discussions and the commit diff.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

T** `l***In*o.m*t**()` *un*tion in ****o v*.*.* *n* **low us*s `p*t*.join()` to ***l wit* wil***r*v*lu*s w*i** **n l*** to *ross *ir**tory risk.

Reasoning

T** vuln*r**ility st*ms *rom t** Tr**.M*t** *un*tion's **n*lin* o* wil***r* v*lu*s in routin* p*tt*rns. Multipl* sour**s (*V* **s*ription, *it*u* issu* #****, *n* *ommit *******) *ir**tly impli**t* t*is *un*tion. T** *ix involv** ***in* p*t*.*l**n()