HTTP: Google Golang Get Command Injection

This signature detects attempts to exploit a known vulnerability in the golang client. Successful exploitation results in arbitrary command injection under the security context of the target user.

Extended Description

The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for "://" anywhere in the string), which allows remote attackers to execute arbitrary OS commands via a crafted web site.

Affected Products

Golang go

References

CVE: CVE-2018-7187

Short Name

HTTP:STC:DL:GOOGLE-GO-CI

Severity

Major

Recommended

True

Recommended Action

Drop

HTTP: Google Golang Get Command Injection

Extended Description

Affected Products

References

Found a potential security threat?