CVE-2025-47906

What it actually does

A flaw in the Go language's `os/exec.LookPath` function can cause it to return an executable file listed directly in the `PATH` environment variable, rather than searching for an executable within the directories listed in `PATH`. This occurs when `LookPath` is called with specific arguments ('', '.', or '..') and the `PATH` variable has been crafted to include a full path to an executable. This can lead to the execution of an arbitrary, attacker-controlled binary by the affected application.

Why it matters to the business

An attacker who can control the environment variables of a process running a vulnerable Go application can trick it into executing malicious code. This could lead to a full system compromise, data theft, or denial of service, especially if the application runs with elevated privileges. The risk is heightened in shared environments or web server contexts where user input can influence process environments.

How an attack unfolds

An attacker first gains the ability to set environment variables for a target application built with a vulnerable version of Go. They craft a malicious `PATH` variable that includes a direct path to their own executable (e.g., `PATH=/tmp/malicious-binary:/usr/bin:/bin`). The attacker then triggers a function in the target application that calls `LookPath` with a problematic argument like '.' or an empty string. The vulnerable function incorrectly interprets the `/tmp/malicious-binary` entry in the `PATH` as a valid result and returns it. The application, trusting this result, then executes the attacker's binary with its own permissions, leading to arbitrary code execution.

How to fix it

The primary remediation is to recompile affected Go applications using a patched version of the Go compiler. The fix was introduced in Go commit `dd8b7ad9268c2fbde675132a41b4e4da02eef94d`. Developers should identify all Go-based applications and rebuild them with a secure toolchain. For Debian systems, upgrade the `openssl` package to version `1.0.0g-1` or later, as it may be linked to this vulnerability in some way. As a defense-in-depth measure, sanitize environment variables, particularly `PATH`, for any processes that execute with elevated privileges or handle untrusted input.

How to confirm the fix worked

To confirm remediation, verify that all Go applications have been recompiled with a patched version of the Go toolchain. You can create a test Go program that uses `LookPath` and run it with a crafted `PATH` variable (e.g., `PATH=/bin/ls:/usr/bin`) and a trigger argument (e.g., `LookPath(".")`). On a vulnerable system, this will return `/bin/ls`; on a patched system, it will correctly search for an executable named `.` and fail to find it. For Debian systems, use `dpkg -l | grep openssl` to ensure the installed version is patched.

Typical attack path

1. An attacker gains local access to a system and identifies a target application built with a vulnerable Go version.
2. The attacker places a malicious executable in a location like `/tmp` or another world-writable directory.
3. The attacker modifies the `PATH` environment variable for the target application's process to include the full path to their malicious executable.
4. The attacker interacts with the application to cause it to invoke the `os/exec.LookPath` function with a trigger argument ('', '.', or '..').
5. The application receives the path to the malicious executable from `LookPath`.
6. The application executes the malicious binary, resulting in code execution with the application's privilege level.

How to detect it

Detecting exploitation requires monitoring process execution and their environment variables. Use security monitoring tools like auditd, Sysmon, or an EDR agent to log process creation events, including the full environment block. Look for anomalies where the `PATH` variable contains entries that are full paths to files rather than directories, especially files located in world-writable locations like `/tmp`, `/var/tmp`, or `/dev/shm`. Correlate such events with the execution of unexpected child processes by legitimate applications.

• process.env.PATH contains '/tmp/'
• process.env.PATH contains '/var/tmp/'
• process.env.PATH contains '/dev/shm/'

What your security team should do

• Immediately identify all internally developed Go applications and prioritize recompiling them with a patched Go toolchain.
• Audit systems for services, daemons, and SUID/SGID executables where the `PATH` environment variable could be influenced by unprivileged users, and implement controls to sanitize it.
• Scan source code for usages of `os/exec.LookPath` to assess potential exposure and ensure it is not called with user-controllable or hardcoded trigger values ('', '.', '..').