CVE-2025-0913
📋 TL;DR
This vulnerability involves inconsistent symlink handling in Go's os.OpenFile function when using O_CREATE|O_EXCL flags on Windows versus Unix systems. On Windows, when a dangling symlink (symlink pointing to nonexistent location) was targeted, the function would create a file at the symlink's destination, potentially allowing file creation in unintended locations. This affects applications using Go's os.OpenFile with those specific flags on Windows systems.
💻 Affected Systems
- Go programming language
- Applications built with Go using os.OpenFile with O_CREATE|O_EXCL flags
📦 What is this software?
Go by Golang
Go by Golang
⚠️ Risk & Real-World Impact
Worst Case
An attacker could create files in arbitrary locations on Windows systems, potentially leading to privilege escalation, data corruption, or denial of service if critical system files are overwritten.
Likely Case
File creation in unintended directories, potentially causing application errors, data integrity issues, or minor privilege boundary violations.
If Mitigated
Limited impact with proper file permission controls and application sandboxing, though unexpected file creation could still occur.
🎯 Exploit Status
Exploitation requires local access or ability to influence file paths in vulnerable applications.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Go version with fix (specific version not provided in references)
Vendor Advisory: https://groups.google.com/g/golang-announce/c/ufZ8WpEsA3A
Restart Required: No
Instructions:
1. Update Go to the patched version. 2. Recompile affected applications with the updated Go compiler. 3. Redeploy updated applications.
🔧 Temporary Workarounds
Avoid O_CREATE|O_EXCL with symlinks
windowsModify code to check for symlinks before using os.OpenFile with O_CREATE|O_EXCL flags
// Add symlink check before os.OpenFile
if _, err := os.Lstat(path); err == nil {
if fi, err := os.Lstat(path); err == nil && fi.Mode()&os.ModeSymlink != 0 {
// Handle symlink case
}
}
🧯 If You Can't Patch
- Implement strict file path validation to prevent user-controlled paths
- Run applications with minimal file system permissions and use sandboxing
🔍 How to Verify
Check if Vulnerable:
Check if application uses os.OpenFile with O_CREATE|O_EXCL flags on Windows and test with dangling symlinksCheck Version:
go versionVerify Fix Applied:
Test the same scenario with updated Go version - os.OpenFile should return error when target is symlink📡 Detection & Monitoring
Log Indicators:
- Unexpected file creation errors
- Permission denied errors in unexpected locations
- Application crashes related to file operations
Network Indicators:
- None - local file system vulnerability
SIEM Query:
Search for file creation events in unexpected directories or symlink-related errors in application logs