CVE-2022-32190

Failure to strip relative path components in net/url

Severity Score

7.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", despite the JoinPath documentation stating that ../ path elements are removed from the result.

JoinPath y URL.JoinPath no eliminan los elementos de ruta ../ anexados a una ruta relativa. Por ejemplo, JoinPath("https://go.dev", "../go") devuelve la URL "https://go.dev/../go", a pesar de que la documentación de JoinPath indica que los elementos de ruta ../ son eliminados del resultado

A flaw was found in the golang package. The JoinPath doesn't remove the ../ path components appended to a domain that is not terminated by a slash, possibly leading to a directory traversal attack.

Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage system with a Ceph management platform, deployment utilities, and support services. This new container image is based on Red Hat Ceph Storage 6.1 and Red Hat Enterprise Linux 9. Issues addressed include bypass, cross site scripting, denial of service, information leakage, spoofing, and traversal vulnerabilities.

*Credits: @q0jt

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Complete

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2022-05-31 CVE Reserved
2022-09-13 CVE Published
2024-08-03 CVE Updated
2025-03-30 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CAPEC

References (6)

URL	Tag	Source
https://groups.google.com/g/golang-announce/c/x49AQzIVX-s	Mailing List

URL	Date	SRC

URL	Date	SRC
https://go.dev/cl/423514	2023-11-07
https://go.dev/issue/54385	2023-11-07
https://pkg.go.dev/vuln/GO-2022-0988	2023-11-07

URL	Date	SRC
https://access.redhat.com/security/cve/CVE-2022-32190	2024-01-31
https://bugzilla.redhat.com/show_bug.cgi?id=2124668	2024-01-31

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Golang Search vendor "Golang"		Go Search vendor "Golang" for product "Go"				1.19.0 Search vendor "Golang" for product "Go" and version "1.19.0"		-		Affected
Golang Search vendor "Golang"		Go Search vendor "Golang" for product "Go"				1.19.0 Search vendor "Golang" for product "Go" and version "1.19.0"		beta1		Affected
Golang Search vendor "Golang"		Go Search vendor "Golang" for product "Go"				1.19.0 Search vendor "Golang" for product "Go" and version "1.19.0"		rc1		Affected
Golang Search vendor "Golang"		Go Search vendor "Golang" for product "Go"				1.19.0 Search vendor "Golang" for product "Go" and version "1.19.0"		rc2		Affected