Malicious Module Content in Go via GOSUMDB Spoofing

Executive Summary

This vulnerability involves a malicious GOSUMDB server that can provide fake module content not recorded in the transparency log. A coordinated GOPROXY and GOSUMDB can trick a client into downloading malicious module content that appears legitimate because the transparency log does not detect the discrepancy.

Useful 0 Not Useful 0

Detection Guidance

To detect if you have been affected by this vulnerability, run the following commands: rm -r go.sum go.work.sum vendor/ && go mod tidy. This will regenerate checksum files and help identify discrepancies.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow attackers to inject malicious code into your Go projects. This could lead to unauthorized access, data breaches, or compromise of systems relying on those modules. Users should remove go.sum, go.work.sum, and vendor/ directories and run go mod tidy to check for inconsistencies.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately remove suspicious module content by running rm -r go.sum go.work.sum vendor/ && go mod tidy. Review proxy and transparency log configurations to ensure they are not colluding to serve malicious modules.

Useful 0 Not Useful 0