CVE-2019-12158
📋 TL;DR
CVE-2019-12158 is a heap-based buffer overflow vulnerability in GoHTTP's GetExtension function that allows remote attackers to execute arbitrary code or cause denial of service by sending a request with an overly long file extension. This affects all users running vulnerable versions of GoHTTP servers.
💻 Affected Systems
- GoHTTP
📦 What is this software?
Gohttp by Gohttp Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Denial of service causing server crashes and service disruption.
If Mitigated
Limited impact with proper network segmentation and exploit prevention controls.
🎯 Exploit Status
The vulnerability is straightforward to exploit with publicly available proof-of-concept code.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 2017-07-25
Vendor Advisory: https://github.com/fekberg/GoHttp/issues/17
Restart Required: Yes
Instructions:
1. Stop the GoHTTP service. 2. Update to the latest version from the official repository. 3. Restart the service.
🔧 Temporary Workarounds
Input Validation Filter
allImplement a reverse proxy or WAF to filter requests with long extensions
# Example nginx location block to reject long URIs
location / {
if ($request_uri ~ "\\.(.{50,})") {
return 403;
}
proxy_pass http://localhost:8080;
}
🧯 If You Can't Patch
- Isolate vulnerable servers in a restricted network segment with no internet access
- Implement strict network access controls and monitor for exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check GoHTTP version - if it's 2017-07-25 or earlier, it's vulnerable.Check Version:
Check the GoHTTP binary or configuration for version informationVerify Fix Applied:
Verify GoHTTP version is newer than 2017-07-25 and test with a proof-of-concept request.📡 Detection & Monitoring
Log Indicators:
- HTTP requests with unusually long file extensions (>50 characters)
- Server crash logs or segmentation faults
Network Indicators:
- HTTP requests with .{ext} where ext is >50 characters
- Unusual traffic patterns to GoHTTP endpoints
SIEM Query:
http.uri contains "." AND length(http.uri) > 100