CVE-2024-24785

What it actually does

A vulnerability in Go's html/template package allows for Cross-Site Scripting (XSS). When a MarshalJSON method returns an error containing user-controlled data, the auto-escaping mechanism can be bypassed. This allows an attacker to inject arbitrary HTML and script content into the rendered web page, as the template engine fails to properly sanitize the content within the error.

Why it matters to the business

Successful exploitation can lead to the compromise of user accounts, theft of sensitive session data (like cookies), and unauthorized actions performed on behalf of the user. This can result in reputational damage, loss of customer trust, and potential regulatory penalties if sensitive data is exposed. The application could also be used as a platform for phishing or distributing malware to its users.

How an attack unfolds

An attacker, authenticated as a low-privileged user, identifies an input field in a Go-based web application that can trigger an error during JSON marshaling. The attacker crafts a malicious input containing a script payload (e.g., `<script>alert(1)</script>`) designed to be reflected within the resulting error message. When the application processes this input, the MarshalJSON function fails and returns an error containing the attacker's payload. The html/template engine then renders this error on a page, but due to the vulnerability, it fails to escape the script tags. The malicious script then executes in the browser of any user who views the page containing the rendered error.

How to fix it

The vulnerability is fixed in Go versions 1.22.1 and 1.21.8. To remediate, upgrade the Go toolchain to a patched version and recompile all affected applications. As a defense-in-depth measure, developers should review custom MarshalJSON implementations and avoid including raw, user-controlled data in returned error strings. If user data must be included, it should be sanitized or encoded before being placed in the error.

How to confirm the fix worked

To validate the fix, verify that applications have been recompiled using a patched Go version (1.22.1+ or 1.21.8+). This can be confirmed by running `go version -m <binary_name>` on the compiled artifact. Additionally, perform penetration testing or dynamic application security testing (DAST) to confirm the XSS vector is no longer exploitable. Testers should attempt to trigger JSON marshaling errors with payloads in user-controlled fields and verify that any reflected output is properly escaped.

Typical attack path

1. Attacker identifies an input field in a Go web application that can trigger an error during JSON marshaling.
2. Attacker crafts a malicious input containing a script payload, designed to be reflected in the error message.
3. Attacker submits the malicious input to the application.
4. The application's MarshalJSON method fails and returns an error containing the attacker's payload.
5. The html/template engine renders the error page, but due to the flaw, it does not escape the attacker's script.
6. The malicious script executes in the victim's browser when they view the resulting page.

How to detect it

To detect potential exploitation, monitor web server access logs and application logs for HTTP requests that appear crafted to trigger errors, followed by server responses (HTTP 5xx or 2xx with error content) containing unescaped HTML or script tags. Web Application Firewall (WAF) logs may also contain alerts for XSS patterns targeting API endpoints or form submissions handled by a Go backend. Focus on error pages or API responses that unexpectedly render HTML content.

What your security team should do

• Identify all applications built with Go and prioritize upgrading the Go toolchain to version 1.22.1 or 1.21.8, followed by recompilation and deployment.
• Instruct development teams to perform static analysis to find custom MarshalJSON implementations that may be vulnerable to this pattern.
• Ensure Web Application Firewall (WAF) rules are enabled and configured to detect and block common XSS attack patterns as a mitigating control.