CVE-2021-3538
📋 TL;DR
This vulnerability in the satori/go.uuid library allows attackers to predict generated UUIDs due to insecure randomness. This affects any application using this library for security-critical UUID generation, potentially enabling session hijacking, privilege escalation, or data manipulation.
💻 Affected Systems
- Applications using github.com/satori/go.uuid library
📦 What is this software?
Uuid by Satori
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through predictable session tokens, authentication bypass, or privilege escalation leading to data theft, ransomware deployment, or system destruction.
Likely Case
Session hijacking, account takeover, or data integrity compromise in applications using UUIDs for security tokens or unique identifiers.
If Mitigated
Limited impact if UUIDs are only used for non-security purposes like database keys without security implications.
🎯 Exploit Status
Exploitation requires the attacker to observe or predict UUID generation patterns. Public proof-of-concept demonstrates the predictability issue.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after commit d91630c8510268e75203009fe7daf2b8e1d60c45
Vendor Advisory: https://github.com/satori/go.uuid/issues/73
Restart Required: Yes
Instructions:
1. Update go.mod to use patched version: go get github.com/satori/go.uuid@latest
2. Rebuild and redeploy application
3. Restart all affected services
🔧 Temporary Workarounds
Switch to alternative UUID library
allReplace satori/go.uuid with google/uuid which uses cryptographically secure random generation
go get github.com/google/uuid
Replace import statements from "github.com/satori/go.uuid" to "github.com/google/uuid"
🧯 If You Can't Patch
- Implement additional authentication layers and session validation
- Monitor for unusual UUID patterns or repeated UUID usage in logs
🔍 How to Verify
Check if Vulnerable:
Check go.mod or vendor directory for satori/go.uuid version. Run: go list -m all | grep satori/go.uuidCheck Version:
go list -m all | grep satori/go.uuidVerify Fix Applied:
Verify updated version: go list -m all | grep satori/go.uuid and confirm version is after commit d91630c8510268e75203009fe7daf2b8e1d60c45📡 Detection & Monitoring
Log Indicators:
- Repeated UUID values in short timeframes
- Predictable UUID patterns in authentication logs
Network Indicators:
- Multiple requests with sequential or predictable session tokens
SIEM Query:
source="application_logs" | regex UUID="[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}" | stats count by UUID | where count > threshold🔗 References
- https://bugzilla.redhat.com/show_bug.cgi?id=1954376
- https://github.com/satori/go.uuid/issues/73
- https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMSATORIGOUUID-72488
- https://bugzilla.redhat.com/show_bug.cgi?id=1954376
- https://github.com/satori/go.uuid/issues/73
- https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMSATORIGOUUID-72488
