Command injection in Go programming language - CVE-2018-6574

Vulnerability identifier: #VU12162

CSH Severity: Low

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-6574

CWE-ID: CWE-77

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to execute arbitrary commands on the target system.

The weakness exists due to "go get" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked. A remote attacker can execute arbitrary commands.

Go programming language
Arch Linux
Gentoo Linux
Amazon Linux AMI
Fedora
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power
Red Hat Developer Tools
golang-1.8 (Debian package)
go (Alpine package)
golang

Update to versions 1.8.7, 1.9.4 or 1.10rc2.

golang-1.8 (Debian package) - update to 1.8.1-1+deb9u1
go (Alpine package) - update to 1.9.4-r0
golang - addressed in versions 1.8.7-1.fc26, 1.9.4-1.el6, 1.9.4-1.fc27

• Exploit #7903 - exploit_CVE-2018-6574 (Exploit for Pentester Labs) (May 27, 2022)
• Exploit #6893 - CVE-2018-6574 (Exploit for remote command execution in Golang go get command.) (October 15, 2021)
• Exploit #2190 - go-get-exploit (CVE-2018-6574) (March 18, 2020)
• Exploit #192 - CVE-in-Ruby (Exploits written & ported to Ruby - no Metasploit) (March 18, 2020)

• https://groups.google.com/forum/#%21topic/golang-nuts/Gbhh1NxAjMU

• Arch Linux update for go
• Arch Linux update for go-pie
• Gentoo update for Go
• Amazon Linux AMI update for golang
• Red Hat update for Go
• Debian update for golang-1.8
• Red Hat update for golang
• Command injection in go (Alpine package)
• Fedora 27 update for golang
• Fedora 26 update for golang
• Fedora EPEL 6 update for golang