CVE-2023-24535
📋 TL;DR
This vulnerability in the Go protobuf library causes a panic when parsing malformed text-format messages containing a minus sign followed by whitespace with no further input. This affects any Go application using the vulnerable protobuf library to parse untrusted text-format messages, potentially leading to denial of service.
💻 Affected Systems
- Go applications using golang/protobuf library
📦 What is this software?
Protobuf by Protobuf
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption through denial of service, potentially cascading to dependent systems if the panic isn't properly handled.
Likely Case
Service crashes or becomes unresponsive when processing malicious input, requiring restart and causing temporary downtime.
If Mitigated
Minimal impact if proper input validation and panic recovery mechanisms are implemented.
🎯 Exploit Status
Exploit is trivial - send malformed text-format protobuf message with minus sign and whitespace. Public PoC exists in GitHub issues.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in golang/protobuf library updates
Vendor Advisory: https://pkg.go.dev/vuln/GO-2023-1631
Restart Required: Yes
Instructions:
1. Update Go protobuf library to patched version
2. Update application dependencies
3. Rebuild and redeploy application
4. Restart affected services
🔧 Temporary Workarounds
Input validation filter
allReject or sanitize text-format protobuf messages containing suspicious patterns before parsing
Implement pre-parsing validation to detect minus-whitespace patterns
Panic recovery wrapper
allWrap protobuf parsing calls with panic recovery to prevent service crashes
defer func() { if r := recover(); r != nil { log.Printf("Recovered from panic: %v", r) } }()
🧯 If You Can't Patch
- Implement strict input validation to reject malformed protobuf messages
- Deploy rate limiting and WAF rules to block suspicious patterns
🔍 How to Verify
Check if Vulnerable:
Check if application uses golang/protobuf library and parses untrusted text-format messagesCheck Version:
go list -m all | grep protobufVerify Fix Applied:
Test with malformed input containing minus sign and whitespace - should not panic📡 Detection & Monitoring
Log Indicators:
- Panic logs mentioning protobuf parsing
- Service crash/restart logs
- Error logs with stack traces
Network Indicators:
- Incoming requests with malformed protobuf content
- Patterns matching minus-whitespace in payloads
SIEM Query:
source="application.logs" AND ("panic" OR "crash") AND "protobuf"