CVE-2023-40023: Github.com/yaklang/yaklang Yaklang Plugin's Fuzztag Component Allows Vulnerability
HIGHCVE-2023-40023 is a HIGH (CVSS 7.5) yaklang plugin's fuzztag component allows vulnerability (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) affecting Github.com/yaklang/yaklang libraries in the Go ecosystem. The issue involves yaklang plugin's fuzztag component allows unauthorized local file reading. Remediation is available by upgrading affected packages to version 1.2.4-sp2.
CVE-2023-40023 at a Glance
Security Impact
CVSS: 7.5
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
How to Fix CVE-2023-40023
To remediate this vulnerability, upgrade all affected Github.com/yaklang/yaklang dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/yaklang/yaklang to 1.2.4-sp2Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/yaklang/yaklangHow to Check if You Are Affected
To determine whether your application is affected by CVE-2023-40023, inspect your project dependencies for Github.com/yaklang/yaklang:
inspect dependencies for github.com/yaklang/yaklangAnalyze the terminal output to locate any version of Github.com/yaklang/yaklang in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.2.4-sp2), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, where the product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. In Github.com/yaklang/yaklang, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2023-40023 Affected Github.com/yaklang/yaklang Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/yaklang/yaklang
|
Go |
< 1.2.4-sp2
|
1.2.4-sp2
|
References
Frequently Asked Questions
What is CVE-2023-40023?
Which Github.com/yaklang/yaklang versions are affected?
What version fixes CVE-2023-40023?
Is github.com/yaklang/yaklang affected?
What is the CVSS score of CVE-2023-40023?
What CWE is associated with CVE-2023-40023?
How can I check Go dependencies for CVE-2023-40023?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-xvhg-w6qc-m3qq",
"modified" : "2023-08-21T19:32:51Z",
"published" : "2023-08-15T20:08:17Z",
"aliases" : [ "CVE-2023-40023" ],
"summary" : "Yaklang Plugin's Fuzztag Component Allows Unauthorized Local File Reading",
"details" : "### Impact\n\nThe Yak Engine has been found to contain a local file inclusion (LFI) vulnerability. This vulnerability allows attackers to include files from the server's local file system through the web application. When exploited, this can lead to the unintended exposure of sensitive data, potential remote code execution, or other security breaches. Users utilizing versions of the Yak Engine prior to 1.2.4-sp1 are impacted.\n\n### Patches\n\nThe vulnerability has been addressed and patched. Users are advised to upgrade to Yak Engine version 1.2.4-sp1 immediately. The patch can be viewed and reviewed at this PR: [https://github.com/yaklang/yaklang/pull/295](https://github.com/yaklang/yaklang/pull/295)，[https://github.com/yaklang/yaklang/pull/296](https://github.com/yaklang/yaklang/pull/296)\n\n### Workarounds\n\nCurrently, the most effective solution is to upgrade to the patched version of Yak Engine (1.2.4-sp1). Users are also advised to avoid exposing vulnerable versions to untrusted input and to closely monitor any unexpected server behavior until they can upgrade.\n\n### References\n\nFor more details on the vulnerability and the corresponding patch, please visit the following link:\n- [PR addressing the LFI vulnerability in Yak Engine](https://github.com/yaklang/yaklang/pull/295)\n- [disable default file fuzztag in fuzz.Pool](https://github.com/yaklang/yaklang/pull/296)\n- [利用yakit功能特性溯源攻击者](https://mp.weixin.qq.com/s?__biz=Mzg5ODE3NTU1OQ==&mid=2247484236&idx=1&sn=ef0c14a89721800b2311d0e487388399)",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/yaklang/yaklang"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "1.2.4-sp2"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/yaklang/yaklang/security/advisories/GHSA-xvhg-w6qc-m3qq"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2023-40023"
}, {
"type" : "WEB",
"url" : "https://github.com/yaklang/yaklang/pull/295"
}, {
"type" : "WEB",
"url" : "https://github.com/yaklang/yaklang/pull/296"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/yaklang/yaklang"
}, {
"type" : "WEB",
"url" : "https://mp.weixin.qq.com/s?__biz=Mzg5ODE3NTU1OQ==&mid=2247484236&idx=1&sn=ef0c14a89721800b2311d0e487388399"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-200" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2023-08-15T20:08:17Z",
"nvd_published_at" : "2023-08-14T20:15:12Z"
}
}