High severity · published Aug 9, 2022
CVE-2022-30580
Empty Cmd.Path can trigger unintended binary in os/exec on Windows
7.8
CVSS
0.6%
EPSS
No
On KEV
Description
Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OS
os/exec · Go standard library
before 1.17.11; 1.18.0-0 before 1.18.3 · source: vendor
GO
GO · Golang
before 1.17.11; 1.18.0 before 1.18.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-30580
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-30580
Vendor Advisory
https://go.dev/cl/403759
Issue Tracking
https://go.dev/issue/52574
Mailing List
https://go.googlesource.com/go/+/960ffa98ce73ef2c2060c84c7ac28d37a83f345e
Mailing List
https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJ
Vendor Advisory
https://pkg.go.dev/vuln/GO-2022-0532
More from os/exec
7.5
CVE-2022-41716
Unsanitized NUL in environment variables on Windows in syscall and os/exec