CVE-2022-30630

What it actually does

The vulnerability exists in the `Glob` function of Go's `io/fs` package. When processing a path string, the function does not properly handle an excessive number of path separators. An attacker can provide a specially crafted string containing a large sequence of these separators, which triggers an uncontrolled recursion. This deep recursion rapidly consumes the application's call stack, leading to a stack exhaustion error. The Go runtime detects this and causes the application to 'panic', effectively crashing the process.

Why it matters to the business

An unauthenticated attacker can remotely crash any public-facing application built with a vulnerable version of Go if it uses the affected function on user-supplied input. This results in a Denial of Service (DoS), making the service unavailable to legitimate users. The impact includes service downtime, potential revenue loss, and damage to brand reputation, especially for critical services where availability is paramount.

How an attack unfolds

An attacker identifies a web service or application built using a vulnerable version of the Go language. They probe the application to find any input vector, such as an API endpoint parameter or a web form field, that accepts a string which is subsequently passed to the `io/fs.Glob` function for file path matching. The attacker then crafts a simple payload consisting of a long string of path separators (e.g., '/////////////////////////////////*'). Upon receiving this payload, the Go application's `Glob` function enters a deep recursive loop, quickly exhausting the stack memory. This triggers a runtime panic, causing the entire application process to terminate abruptly and rendering the service offline.

How to fix it

The definitive fix is to upgrade the Go development environment and rebuild all affected applications. Developers must update their toolchain to Go version 1.17.12 or later, or Go version 1.18.4 or later. After upgrading, all Go applications must be recompiled with the patched compiler and then redeployed to production environments. As a temporary mitigation where patching is not immediately feasible, implement strict input validation to sanitize and limit the length and character sequences of any user-provided strings that are used in file path operations.

How to confirm the fix worked

To confirm remediation, verify that all build pipelines and developer environments are using a patched Go version (1.17.12+ or 1.18.4+) by running `go version`. For compiled binaries, use `go version <binary-file>` to check the embedded toolchain version. To test for the vulnerability, create a proof-of-concept that calls `io/fs.Glob` with a malicious string (e.g., `fs.Glob(os.DirFS("."), "//...<many slashes>...//*")`). A vulnerable application will crash, whereas a patched application will handle the input without terminating, likely returning an error or an empty result.

Typical attack path

1. The attacker identifies a target service built with a vulnerable Go version (prior to 1.17.12 or 1.18.4).
2. The attacker discovers an input field (e.g., API parameter, search query) that passes user data to a file path globbing function.
3. The attacker crafts a string containing an excessive number of path separators (e.g., hundreds of '/' characters).
4. The attacker submits the malicious string to the vulnerable input field.
5. The Go application attempts to process the string, triggering uncontrolled recursion in the `Glob` function.
6. The application's stack overflows, causing a panic and process termination, resulting in a Denial of Service.

How to detect it

A successful exploit will result in an application crash. Monitor application and system logs for panic messages, specifically looking for the string 'panic: runtime error: stack overflow'. The stack trace associated with the panic will likely reference functions within the `io/fs` or `path/filepath` packages, such as `glob`. Correlate these crash events with inbound network requests in web server or API gateway logs that contain unusually long sequences of path separator characters (e.g., '/') in URI paths, query parameters, or request bodies.

• panic: runtime error: stack overflow
• in stack trace: io/fs.(*glob).glob
• in stack trace: path/filepath.glob

What your security team should do

• Immediately identify all applications built with vulnerable Go versions (before 1.17.12 and 1.18.4) and prioritize them for patching.
• Coordinate with development teams to recompile and redeploy all identified applications using an updated Go toolchain.
• Use Software Composition Analysis (SCA) tools to scan your codebase and artifacts to ensure no vulnerable Go versions are in use.
• Recommend developers implement robust input validation on all user-controlled data that is passed to filesystem functions as a defense-in-depth practice.