| id: GO-2022-0532 | |
| modules: | |
| - module: std | |
| versions: | |
| - fixed: 1.17.11 | |
| - introduced: 1.18.0-0 | |
| - fixed: 1.18.3 | |
| vulnerable_at: 1.18.2 | |
| packages: | |
| - package: os/exec | |
| goos: | |
| - windows | |
| symbols: | |
| - Cmd.Start | |
| summary: Empty Cmd.Path can trigger unintended binary in os/exec on Windows | |
| description: |- | |
| On Windows, executing Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when | |
| Cmd.Path is unset will unintentionally trigger execution of any binaries in the | |
| working directory named either "..com" or "..exe". | |
| published: 2022-07-26T21:41:20Z | |
| credits: | |
| - Chris Darroch (chrisd8088@github.com) | |
| - brian m. carlson (bk2204@github.com) | |
| - Mikhail Shcherbakov (https://twitter.com/yu5k3) | |
| references: | |
| - fix: https://go.dev/cl/403759 | |
| - fix: https://go.googlesource.com/go/+/960ffa98ce73ef2c2060c84c7ac28d37a83f345e | |
| - report: https://go.dev/issue/52574 | |
| - web: https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJ | |
| cve_metadata: | |
| id: CVE-2022-30580 | |
| cwe: 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' | |
| description: |- | |
| Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows | |
| execution of any binaries in the working directory named either "..com" or | |
| "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when | |
| Cmd.Path is unset. | |
| review_status: REVIEWED |