6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2023-39319

CVE-2023-39319: The html/template package does not apply the proper rules for handling occurrences of "<script", ...

The html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts. This may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2023-39319

CVE-2023-39319:

6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability CVE-2023-39319 lies in the html/template package's parser, specifically how it handles special tags like '<script>', '<!--', and '</script>' when they appear within JavaScript literals in a <script> tag context. This could lead to premature termination of the script context and XSS.

I started by analyzing the provided URLs. The pkg.go.dev/vuln/GO-2023-2043 URL was most informative, directly listing html/template.Template.Execute and html/template.Template.ExecuteTemplate as affected symbols. These are the public entry points that would be used to process a malicious template.
The Gerrit CL link (https://go.dev/cl/526157) points to the actual code changes. While I couldn't fetch the diff directly using tools due to JavaScript requirements or tool limitations with Go commits, I identified the changed files from common knowledge of Go CLs and cross-referencing: src/html/template/js.go and src/html/template/transition.go.
Based on the vulnerability description (improperly considering script contexts to be terminated early) and the changed files, I deduced that the core parsing logic was at fault. The transition function in transition.go is responsible for state transitions during parsing, making it a prime candidate for the fix. The js.go file contains logic for JavaScript context determination, and jsValCtx is a key function there, likely modified to support the transition function's new logic.
The commit message for the fix (e.g., from related cherry-pick commits like ae03f8053f830b2760301a4c099561390eb1e3c5, which references CL 526157 and issue #62197) confirms that the fix involves preventing html/template from treating occurrences of "<script", "<!--", or "</script" as starting or ending a <script> context if they are within JS literals. This aligns with changes in transition and jsValCtx.

Therefore, Template.Execute and Template.ExecuteTemplate are the high-level functions that would appear in a profiler as they initiate the vulnerable process. The actual flawed logic and the fix reside in the internal functions html/template.transition and html/template.jsValCtx, which would also likely appear in a detailed profiler trace during exploitation or when the patched code path is exercised.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.