x/vulndb: potential Go vuln in github.com/go-resty/resty/v2: CVE-2023-45286

[lattwood]

Acknowledgement

• The maintainer(s) of the affected project have already been made aware of this vulnerability.

Description

go-resty v2.10.0 introduced a race condition that results in HTTP request body disclosure across requests, by calling sync.Pool.Put with the same *bytes.Buffer more than once, when request retries are enabled and a retry occurs.

When this condition is triggered, the call to sync.Pool.Get will return a bytes.Buffer that hasn't had bytes.Buffer.Reset called on it. This dirty buffer will contain the HTTP request body from an unrelated request, and go-resty will append the current HTTP request body to it, sending two bodies in one request.

The sync.Pool in question is defined at package level scope, so a completely unrelated server could receive the request body.

Affected Modules, Packages, Versions and Symbols

Module: github.com/go-resty/resty/v2
Package: github.com/go-resty/resty/v2
Versions:
  - Introduced: 2.10.0
  - Fixed: N/A
Symbols:
  - Client.SetRetryCount

CVE/GHSA ID

No response

Fix Commit or Pull Request

go-resty/resty#745

References

• race condition detected here: DATA RACE in resty's middleware (go-resty/resty/v2.releaseBuffer()) go-resty/resty#739
• also reported here: Request body is written multiple times go-resty/resty#743
• unacknowledged PR fixing the security issue: Security: Don't put the same bytes.Buffer into sync.Pool twice go-resty/resty#745

Additional information

It would be awesome if sync.Pool kept track of returned memory addresses when go's race detector is enabled, it would have made tracking this down a lot faster.

[lattwood]

Dang.

https://github.com/search?q=resty+SetRetryCount+language%3AGo&type=code

Just a little bit of vulnerable code.

[gopherbot]

Change https://go.dev/cl/545206 mentions this issue: data/reports: add GO-2023-2328.yaml

[tatianab]

Hi, thank you for your report, and apologies for the delay. This vulnerability has been assigned ids GO-2023-2328 and CVE-2023-45286. The report in CL https://go.dev/cl/545206 will be published soon; please comment here or on that CL if you have any suggested edits.

[lattwood]

No worries, and thank you!

[gopherbot]

Change https://go.dev/cl/547980 mentions this issue: data/reports: update GO-2023-2328.yaml

[gopherbot]

Change https://go.dev/cl/554135 mentions this issue: data/reports: add GO-2023-2328.yaml

[gopherbot]

Change https://go.dev/cl/554155 mentions this issue: data/reports: update GO-2023-2328.yaml