9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2023-24531

CVE-2023-24531: Output of "go env" does not sanitize values in cmd/go

Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executing its output as a shell script can cause various bad bahaviors, including executing arbitrary commands or inserting new environment variables. This issue is relatively minor because, in general, if an attacker can set arbitrary environment variables on a system, they have better attack vectors than making "go env" print them out.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2023-24531

CVE-2023-24531:

9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability CVE-2023-24531 states that 'go env' doesn't sanitize values when outputting a shell script, potentially leading to command execution. The provided reference URLs point to Gerrit CLs 488375 ('cmd/go: escape go env output for shell security') and 493535 (a backport). I fetched the content of src/cmd/go/internal/envcmd/env.go from the 'golang/go' repository, which contains the implementation for the 'go env' command. The main logic for printing environment variables resides in the PrintEnv function. This function iterates over environment variables and prints them. Crucially, it has a 'switch runtime.GOOS' block to handle OS-specific quoting. For the 'default' case (covering POSIX-like shells), the current, patched code uses fmt.Fprintf(w, \"%s=%s\\n\", e.Name, shellQuote(e.Value)). The vulnerability implies that before this patch, e.Value was either not passed through a sanitizing function like shellQuote, or the sanitizing function was flawed or absent, leading to the direct output of potentially malicious values. Thus, PrintEnv is the function that directly handled the unsanitized data and produced the vulnerable output. The function runEnv calls PrintEnv, but PrintEnv is where the specific formatting and output logic resides.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.