GO-2022-0532

vendorUSosv

Empty Cmd.Path can trigger unintended binary in os/exec on Windows

view advisory published 2022-07-26Licence: per source

On Windows, executing Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset will unintentionally trigger execution of any binaries in the working directory named either "..com" or "..exe".

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-30580US	high7.8	0.63% (50th)	—	2022-08-10
Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run,…

references

External citations — patches, advisories, analysis.

https://go.dev/cl/403759FIX
https://go.dev/issue/52574REPORT
https://go.googlesource.com/go/+/960ffa98ce73ef2c2060c84c7ac28d37a83f345eFIX
https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan