CVE-2020-24553: XSS
A flaw was found in the Go standard library packages before upstream versions 1.15 and 1.14.8. Both the net/http/cgi and net/http/fcgi packages use a default Content-Type response header value of "text/html", rather than "text/plain". This flaw allows an attacker to exploit this issue in applications using these packages by uploading crafted files, allowing a Cross-site Scripting attack (XSS). The highest threat from this vulnerability is to confidentiality and integrity.
Other sources
Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.
Golang Go is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the CGI/FCGI handlers. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
— IBM
In Go versions prior to 1.15.1 and 1.14.8 if the Content-Type header of a Handler was not explicitly set the net/http/cgi and net/http/fcgi packages would default to “text/html”, which could cause a Cross-Site Scripting vulnerability if an attacker can control any part of the contents of a response.
Upstream Reference:
https://groups.google.com/g/golang-announce/c/8wqlSbkLdPs/m/UccMwBPUBAAJ?pli=1
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID of this flaw?
The vulnerability ID of this flaw is CVE-2020-24553.
What is the severity of CVE-2020-24553?
The severity of CVE-2020-24553 is high with a CVSS score of 7.2.
How can an attacker exploit this vulnerability?
An attacker can exploit this vulnerability by exploiting the default Content-Type response header value of "text/html" in the net/http/cgi and net/http/fcgi packages in Go.
Which versions of Go are affected by this vulnerability?
Versions of Go before 1.14.8 and 1.15.x before 1.15.1 are affected by this vulnerability.
How can I fix CVE-2020-24553?
To fix CVE-2020-24553, update your Go installation to version 1.14.8 or 1.15.1.