Skip to main content

Use of software with known vulnerabilities

Need​

Updating software and dependencies to versions without known vulnerabilities

Context​

  • Usage of Go 1.16 for developing high-performance and concurrent applications
  • Usage of Gin for building web applications in Go
  • Usage of sessions package from github.com/gin-contrib for managing user sessions in Gin framework
  • Usage of cookie-based sessions with the github.com/gin-contrib/sessions/cookie package

Description​

Non compliant code​

package main

import (
	"github.com/gin-gonic/gin"
	"github.com/gin-contrib/sessions"
	"github.com/gin-contrib/sessions/cookie"
)

func main() {
	r := gin.Default()
	store := cookie.NewStore([]byte("secret"))
	r.Use(sessions.Sessions("mysession", store))

	r.GET("/home", func(c *gin.Context) {
		session := sessions.Default(c)
		session.Set("user", "John Doe")
		session.Save()
		c.JSON(200, gin.H{"message": "Home page"})
	})

	r.Run(":8080")
}

This code snippet is a simple Go application running on the Gin web framework. It also uses the gin-contrib/sessions library for session management.

The vulnerability lies in the usage of an outdated version of the gin-contrib/sessions library. This library is known to have vulnerabilities in certain versions. The vulnerabilities could potentially allow an attacker to hijack user sessions, leading to unauthorized access to sensitive information.

The cookie.NewStore([]byte("secret")) line creates a new cookie-based session store. The r.Use(sessions.Sessions("mysession", store)) line sets up the session middleware, using the name "mysession" and the previously created store.

In the /home route handler, a new session is created and a user is set to "John Doe". This is just a placeholder value, in a real-world application this would be dynamic.

The application is running on port 8080.

The code doesn't specify the version of the gin-contrib/sessions library being used. It's crucial to always use the latest version of your dependencies to avoid known vulnerabilities. It's recommended to regularly update your dependencies and check for any known vulnerabilities.

Steps​

  • Regularly update the software and dependencies used in the application.
  • Monitor security advisories and vulnerability databases to stay informed about any known vulnerabilities in the software or dependencies.
  • Upgrade to the latest version of the software or dependency that addresses the known vulnerabilities.
  • Ensure that the updated software or dependency is compatible with the application and does not introduce any breaking changes.
  • Test the application thoroughly after the update to ensure that it functions correctly and does not introduce any new vulnerabilities.
  • Implement a process to regularly check for and apply updates to the software and dependencies used in the application.

Compliant code​

package main

import (
	"github.com/gin-gonic/gin"
	"github.com/gin-contrib/sessions"
	"github.com/gin-contrib/sessions/cookie"
)

func main() {
	r := gin.Default()
	store := cookie.NewStore([]byte("secret"))
	r.Use(sessions.Sessions("mysession", store))

	r.GET("/home", func(c *gin.Context) {
		session := sessions.Default(c)
		session.Set("user", "John Doe")
		session.Save()
		c.JSON(200, gin.H{"message": "Home page"})
	})

	r.Run(":8080")
}

The above code is a simple Go application using the Gin framework and the sessions middleware. The application sets up a session store using a secret key and attaches a session to each request. In the "/home" route, it sets a session variable "user" and saves the session.

The vulnerability lies in the use of outdated or vulnerable versions of the software or dependencies. If the versions of Gin, the sessions middleware, or any other dependencies used in the application have known vulnerabilities, it can expose the application to potential attacks.

To fix this vulnerability, you should:

  1. Regularly update the software and dependencies used in the application. This includes the Gin framework, the sessions middleware, and any other dependencies.

  2. Monitor security advisories and vulnerability databases to stay informed about any known vulnerabilities in the software or dependencies you are using.

  3. Upgrade to the latest version of the software or dependency that addresses the known vulnerabilities. This can often be done using the package manager for your language (like go get -u for Go).

  4. Ensure that the updated software or dependency is compatible with the application and does not introduce any breaking changes. This may involve reading the documentation or changelogs for the software or dependency, or testing the application thoroughly after the update.

  5. Implement a process to regularly check for and apply updates to the software and dependencies used in the application. This could be a manual process, or you could use tools or services that automate dependency updates.

By following these steps, you can reduce the risk of your application being compromised due to known vulnerabilities in the software or dependencies it uses.

References​

Last updated on