CVE-2023-24538
Backticks not treated as string delimiters in html/template
描述
Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template action within a Javascript template literal, the contents of the action can be used to terminate the literal, injecting arbitrary Javascript code into the Go template. As ES6 template literals are rather complex, and themselves can do string interpolation, the decision was made to simply disallow Go template actions from being used inside of them (e.g. "var a = {{.}}"), since there is no obviously safe way to allow this behavior. This takes the same approach as github.com/google/safehtml. With fix, Template.Parse returns an Error when it encounters templates like this, with an ErrorCode of value 12. This ErrorCode is currently unexported, but will be exported in the release of Go 1.21. Users who rely on the previous behavior can re-enable it using the GODEBUG flag jstmpllitinterp=1, with the caveat that backticks will now be escaped. This should be used with caution.
如何修補 CVE-2023-24538
要修補 CVE-2023-24538,請將受影響套件升級到下列已修補版本。
- —升級至 1.19.8 或更新版本
- —未列出修補版本
- —升級至 1.19.8-2 或更新版本
- —升級至 1.19.8 或更新版本
CVE-2023-24538 正在被利用嗎?
低 — EPSS 為 2.3%,目前沒有觀察到大規模利用活動。
受影響套件(4)
- from 0, < 1.19.8, >= 1.20.0, < 1.20.3
- from 0
- from 0, < 1.19.8-2
- from 0, < 1.19.8, >= 1.20.0-0, < 1.20.3
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | CRITICAL9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |