CVE-2023-24539
📋 TL;DR
This is a cross-site scripting (XSS) vulnerability in Go's html/template package where angle brackets in CSS contexts aren't properly escaped. It affects Go applications using html/template with untrusted input in CSS contexts, potentially allowing attackers to inject malicious scripts.
💻 Affected Systems
- Go programming language
📦 What is this software?
Go by Golang
Go by Golang
⚠️ Risk & Real-World Impact
Worst Case
Full XSS exploitation leading to session hijacking, credential theft, or complete client-side compromise of users visiting vulnerable pages.
Likely Case
Limited XSS allowing attackers to steal session cookies or perform actions on behalf of authenticated users.
If Mitigated
No impact if proper input validation and output encoding are already implemented beyond the vulnerable template functions.
🎯 Exploit Status
XSS vulnerabilities are commonly exploited and tooling exists for automated exploitation. The specific injection pattern requires specific template structures.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Go 1.20.4 and 1.19.9
Vendor Advisory: https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU
Restart Required: Yes
Instructions:
1. Update Go to version 1.20.4 or 1.19.9. 2. Recompile and redeploy all affected applications. 3. Restart services using the updated binaries.
🔧 Temporary Workarounds
Input validation for CSS contexts
allImplement strict input validation for any data that will be placed in CSS contexts within templates
Avoid untrusted input in CSS
allRefactor templates to avoid placing untrusted user input in CSS contexts entirely
🧯 If You Can't Patch
- Implement Content Security Policy (CSP) headers to mitigate XSS impact
- Use additional output encoding libraries specifically for CSS contexts
🔍 How to Verify
Check if Vulnerable:
Check if application uses Go's html/template package with untrusted input in CSS contexts and runs on Go <1.20.4 or <1.19.9Check Version:
go versionVerify Fix Applied:
Verify Go version is 1.20.4+ or 1.19.9+ and application has been recompiled with updated version📡 Detection & Monitoring
Log Indicators:
- Unusual angle bracket patterns in CSS content
- Multiple '/' characters in template output
Network Indicators:
- Script tags or JavaScript in CSS contexts in HTTP responses
SIEM Query:
web_logs WHERE (url_contains 'css' OR content_type_contains 'css') AND (response_body_contains '<script>' OR response_body_contains 'javascript:')🔗 References
- https://go.dev/cl/491615
- https://go.dev/issue/59720
- https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU
- https://pkg.go.dev/vuln/GO-2023-1751
- https://go.dev/cl/491615
- https://go.dev/issue/59720
- https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU
- https://pkg.go.dev/vuln/GO-2023-1751
- https://security.netapp.com/advisory/ntap-20241129-0005/
