GO-2024-3293

See a problem?
Please try reporting it to the source first.

Source

https://pkg.go.dev/vuln/GO-2024-3293

Import Source

https://vuln.go.dev/ID/GO-2024-3293.json

JSON Data

https://api.osv.dev/v1/vulns/GO-2024-3293

Published

2024-12-13T20:59:35Z

Modified

2024-12-13T20:59:35Z

Summary

Full access to the host's OS file system using osfs.FS with Router.Static in goyave.dev/goyave/v5

Details

Static file serving using router.Static and osfs.FS allows clients to access any file on the host file system using relative paths because the requested path is not sanitized and . and .. segments are accepted. The files will be returned as a response, provided the system user running the Go application has read access to the requested file.

As a workaround, use fsutil.NewEmbed(embeddedFS) from the goyave.dev/goyave/v5/util/fsutil package to serve static content using Router.Static instead of &osfs.FS. Embedded file systems are rooted to the specified directory, making it impossible to navigate outside of the developers' intended directory.

Database specific

{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2024-3293"
}

References

Affected packages

Go / goyave.dev/goyave/v5

Package

Name: goyave.dev/goyave/v5; View open source insights on deps.dev
Purl: pkg:golang/goyave.dev/goyave/v5

Affected ranges

Type: SEMVER
Events: Introduced

5.0.0

Fixed

5.5.0

Ecosystem specific

{
    "imports": [
        {
            "path": "goyave.dev/goyave/v5",
            "symbols": [
                "Router.ServeHTTP",
                "Router.Static",
                "Server.Start",
                "cleanStaticPath",
                "staticHandler"
            ]
        }
    ]
}