CVE-2022-30633

What it actually does

A flaw in the `encoding/xml` package's `Unmarshal` function allows for uncontrolled recursion when parsing a specially crafted XML document. An attacker can exploit this to cause a stack exhaustion, which triggers a panic and crashes the application process.

Why it matters to the business

Exploitation of this vulnerability leads to a denial of service (DoS). Any application built with a vulnerable version of Go that parses untrusted XML is susceptible. A successful attack can crash critical services, leading to downtime, operational disruption, and potential reputational damage.

How an attack unfolds

An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted XML payload to a server or application that uses a vulnerable version of Go's `encoding/xml` library. The XML is constructed to target a Go struct with a nested field that uses the 'any' field tag. When the application's `Unmarshal` function attempts to parse this malicious XML, it enters an infinite recursive loop. This recursion rapidly consumes the process's call stack, leading to a stack overflow. The Go runtime detects this condition and triggers a panic, which terminates the application, resulting in a denial of service.

How to fix it

To remediate this vulnerability, developers must upgrade their Go development environment and recompile their applications. Update to Go version 1.17.12 or later, or Go version 1.18.4 or later. After upgrading the Go toolchain, all affected Go applications must be recompiled and redeployed to incorporate the fix.

How to confirm the fix worked

To validate the fix, verify that all Go applications have been recompiled with a patched version of the Go compiler (1.17.12+ or 1.18.4+). You can check the Go version used to build a binary by running `go version -m <binary_path>` if build information is included. To identify vulnerable instances, inventory all Go applications and check their build versions. Any application built with a version prior to the fixed versions that also parses untrusted XML should be considered vulnerable.

Typical attack path

1. The attacker identifies a web service or application built with a vulnerable version of the Go programming language that accepts XML data from users.
2. The attacker crafts a malicious XML document with a deeply nested structure that maps to a Go struct containing a field with the 'any' tag.
3. The attacker sends the malicious XML document to the target application's exposed endpoint.
4. The application attempts to parse the XML using the vulnerable `Unmarshal` function in the `encoding/xml` package.
5. The function enters an uncontrolled recursion, exhausting the memory stack.
6. The Go runtime triggers a panic, causing the application to crash and become unavailable.

How to detect it

To detect potential exploitation, monitor application logs for unexpected crashes or panics. Specifically, look for log entries from the Go runtime indicating a stack overflow, such as 'panic: runtime error: stack overflow'. Correlate these crash events with inbound network traffic to identify if the crash was preceded by the receipt of an XML payload. If possible, inspect the XML payloads associated with crashes for deeply nested, recursive structures.

• panic: runtime error: stack overflow

What your security team should do

• Immediately identify all applications in your environment built with the Go programming language.
• Prioritize patching for public-facing services and critical internal applications that parse XML from untrusted sources.
• Ensure all development and build environments are updated to use Go version 1.17.12 or 1.18.4 or a newer release.
• Track the recompilation and redeployment of all identified Go applications to ensure the patch is applied across the entire estate.