CVE-2023-29400 — Injection in Standard Library Html Template

CWE-74 — InjectionCWE-94 — Code InjectionCWE-176 — Improper Handling of Unicode Encoding9 documents8 sources
Severity
7.3HIGHNVD
EPSS
0.0%
top 85.19%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
GO Standard Library Html TemplateGolang GO
Timeline
PublishedMay 11
Latest updateJun 6

Description

Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LExploitability: 3.9 | Impact: 3.4

Affected Packages2 packages

▶CVEListV5go_standard_library/html_template1.20.0-0 — 1.20.4+1
▶NVDgolang/go1.20.0 — 1.20.4+1

Patches

Patch: go.dev ↗Patch: go.dev ↗Patch: go.dev ↗

🔴Vulnerability Details

4
CVEList
Improper handling of empty HTML attributes in html/template↗2023-05-11
▶
OSV
CVE-2023-29400: Templates containing actions in unquoted HTML attributes (e↗2023-05-11
▶
GHSA
GHSA-c9hr-fvm9-7c49: Templates containing actions in unquoted HTML attributes (e↗2023-05-11
▶
OSV
Improper handling of empty HTML attributes in html/template↗2023-05-05
▶

📋Vendor Advisories

4
Ubuntu
Go vulnerabilities↗2023-06-06
▶
Microsoft
Improper handling of empty HTML attributes in html/template↗2023-05-09
▶
Red Hat
golang: html/template: improper handling of empty HTML attributes↗2023-04-20
▶
Debian
CVE-2023-29400: golang-1.15 - Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") exe...↗2023
▶
CVE-2023-29400 — Injection | cvebase