CVE-2025-0913

What it actually does

The os.OpenFile function in Go exhibits inconsistent behavior between Unix and Windows systems when handling dangling symbolic links with O_CREATE and O_EXCL flags. On a vulnerable Windows system, if the path provided to OpenFile is a symbolic link to a non-existent location, the function will create a file at the target of the symlink. This allows an attacker to control the location where a file is created, potentially bypassing file system access controls and writing a file outside of the intended directory.

Why it matters to the business

This vulnerability can lead to unauthorized file creation in sensitive system locations, which could result in privilege escalation, denial of service, or arbitrary code execution. An attacker could overwrite critical system files, place malicious scripts in startup directories, or fill up disk space in critical partitions. This compromises system integrity and availability, potentially leading to a full system takeover and disruption of business operations.

How an attack unfolds

An attacker with low-privilege access to a Windows machine first identifies a Go application that uses the vulnerable os.OpenFile function to create files (e.g., lock files or temporary files) in a predictable location. The attacker then creates a symbolic link at this predictable location, pointing to a sensitive destination path where the attacker does not have direct write permissions (e.g., C:\Windows\System32). When the legitimate Go application executes and attempts to create its file, the vulnerable function on Windows follows the attacker's symbolic link and creates the file in the sensitive destination directory. If the application writes executable content or configuration data to this file, the attacker could achieve privilege escalation or code execution.

How to fix it

The primary remediation is to update the Go language distribution and recompile affected applications. Developers should ensure their build environments use a Go version that includes the fix (commit d375ae50633cdf1cd8536f2a199c382f9053b638 or later). For systems running pre-compiled software like Jenkins, upgrade to a patched version, such as Jenkins Chainguard image 2.492.3-r4 or newer. If immediate patching is not feasible, restrict permissions in directories where applications create temporary files to prevent unauthorized users from creating symbolic links.

How to confirm the fix worked

To validate the fix, verify that all Go applications are compiled with a patched version of the Go compiler. On Windows systems, you can create a test Go program that uses `os.OpenFile` with `O_CREATE|O_EXCL` on a path that is a dangling symlink. On a vulnerable system, the file will be created at the symlink's target. On a patched system, the function call will return an error. Security teams should audit application inventories to identify software built with Go and confirm their build versions.

Typical attack path

1. An attacker gains initial low-privilege access to a target Windows system.
2. The attacker identifies a Go-based application that performs file creation using the vulnerable `os.OpenFile` call.
3. The attacker creates a symbolic link from the application's expected file path to a privileged or sensitive directory.
4. The attacker waits for or triggers the vulnerable application to perform the file creation operation.
5. The application follows the symlink and creates a file in the attacker-chosen sensitive location, leading to a security bypass or privilege escalation.

How to detect it

Exploitation of this vulnerability requires an attacker to first create a symbolic link. Security teams should monitor for the creation of symbolic links on Windows endpoints, especially in directories used by Go applications for temporary file storage. Look for command-line activity involving `mklink` or PowerShell's `New-Item -ItemType SymbolicLink`. Correlate this activity with subsequent anomalous file creation events by Go application processes in unexpected directories. Endpoint Detection and Response (EDR) logs and Windows Security Event Logs (ID 4688 for process creation, and file access auditing) are key data sources.

• cmd.exe /c mklink
• powershell.exe New-Item -ItemType SymbolicLink

What your security team should do

• Immediately patch all Go development and build environments to a non-vulnerable version to prevent the creation of new vulnerable software.
• Inventory all Go-based applications running on Windows hosts and prioritize them for recompilation or updates.
• Apply vendor-supplied patches for affected third-party software, such as Jenkins, as soon as they are available.
• As a compensating control, implement file system monitoring to detect and alert on the creation of symbolic links in unusual locations or by unauthorized users.