CVE-2021-27918
📋 TL;DR
This vulnerability in Go's XML encoding package causes an infinite loop when a custom TokenReader returns EOF in the middle of an XML element. This can lead to denial of service by consuming excessive CPU resources. Any Go application using xml.NewTokenDecoder with custom TokenReader implementations is affected.
💻 Affected Systems
- Go programming language
📦 What is this software?
Go by Golang
Go by Golang
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service through CPU exhaustion, potentially causing application crashes and service unavailability.
Likely Case
Application hangs or becomes unresponsive when processing malformed XML with custom TokenReader implementations.
If Mitigated
Minimal impact if proper input validation and error handling are implemented, though CPU spikes may still occur.
🎯 Exploit Status
Exploitation requires knowledge of custom TokenReader implementation and ability to provide malformed XML input.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Go 1.15.9, Go 1.16.1
Vendor Advisory: https://groups.google.com/g/golang-announce/c/MfiLYjG-RAw
Restart Required: Yes
Instructions:
1. Update Go installation to version 1.15.9 or 1.16.1+. 2. Recompile all Go applications with updated version. 3. Restart affected services.
🔧 Temporary Workarounds
Input validation for XML
allImplement strict input validation and sanitization for XML input to prevent malformed data from reaching vulnerable code paths.
Timeout implementation
allAdd timeout mechanisms to XML parsing operations to prevent infinite loops from causing permanent hangs.
🧯 If You Can't Patch
- Implement circuit breakers and monitoring for CPU usage spikes during XML processing
- Deploy rate limiting and input size restrictions for XML processing endpoints
🔍 How to Verify
Check if Vulnerable:
Check Go version with 'go version' command and verify if using xml.NewTokenDecoder with custom TokenReader implementations.Check Version:
go versionVerify Fix Applied:
Confirm Go version is 1.15.9+ or 1.16.1+ and test XML parsing with edge cases that previously caused hangs.📡 Detection & Monitoring
Log Indicators:
- High CPU usage spikes
- XML parsing timeouts
- Application hang/crash logs
Network Indicators:
- Increased XML payload sizes to vulnerable endpoints
- Repeated XML requests causing service degradation
SIEM Query:
source="application_logs" AND ("CPU spike" OR "XML parse timeout" OR "application hang")