Skip to main content

Use of software with known vulnerabilities in development

Need​

Mitigation of software vulnerabilities in development

Context​

  • Usage of Go 1.16 for developing high-performance and efficient applications
  • Usage of gin-gonic/gin for building web applications in Go
  • Usage of sessions package from github.com/gin-contrib for managing user sessions in a Gin web framework application
  • Usage of cookie-based sessions with the github.com/gin-contrib/sessions/cookie package in a Gin framework application

Description​

Non compliant code​

package main

import (
    "github.com/gin-gonic/gin"
    "github.com/gin-contrib/sessions"
    "github.com/gin-contrib/sessions/cookie"
)

func main() {
    router := gin.Default()
    
    // This is the vulnerable part. The version of gin-contrib/sessions may have known vulnerabilities.
    store := cookie.NewStore([]byte("secret"))
    router.Use(sessions.Sessions("mysession", store))

    router.GET("/hello", func(c *gin.Context) {
        session := sessions.Default(c)
        session.Set("hello", "world")
        session.Save()
        c.JSON(200, gin.H{"hello": "world"})
    })
    router.Run(":8080")
}

The code above is a simple Golang application using the Gin framework and the gin-contrib/sessions library for session management. The application sets up a cookie store for session data and uses it in a middleware function that gets applied to all routes.

The vulnerability lies in the use of a potentially outdated version of the gin-contrib/sessions library. If this version contains known security vulnerabilities, it could lead to several risks, including session hijacking, Cross-Site Scripting (XSS), and potentially even Remote Code Execution (RCE), depending on the nature of the vulnerabilities in the used version.

It's crucial to keep all dependencies, such as libraries and frameworks, up-to-date to prevent exploitation of known vulnerabilities. Regularly updating these components should be part of the development and maintenance process of the application.

Steps​

  • Identify the specific version of gin-contrib/sessions that is being used.
  • Research the known vulnerabilities associated with the identified version.
  • Upgrade the gin-contrib/sessions dependency to a version that does not have any known vulnerabilities.
  • Ensure that the new version of gin-contrib/sessions is compatible with the current codebase.
  • Update the code to use the upgraded version of gin-contrib/sessions.
  • Test the application thoroughly to ensure that it functions correctly with the updated dependency.
  • Monitor for any new vulnerabilities in the future and regularly update dependencies to address them.

Compliant code​

package main

import (
    "github.com/gin-gonic/gin"
    "github.com/gin-contrib/sessions"
    "github.com/gin-contrib/sessions/cookie"
)

func main() {
    router := gin.Default()
    
    // The version of gin-contrib/sessions has been updated to a version without known vulnerabilities.
    store := cookie.NewStore([]byte("secret"))
    router.Use(sessions.Sessions("mysession", store))

    router.GET("/hello", func(c *gin.Context) {
        session := sessions.Default(c)
        session.Set("hello", "world")
        session.Save()
        c.JSON(200, gin.H{"hello": "world"})
    })
    router.Run(":8080")
}

The original code was using a version of the gin-contrib/sessions package that had known vulnerabilities. This could potentially expose the application to security risks.

The updated code now uses a version of gin-contrib/sessions that does not have any known vulnerabilities. This was achieved by identifying the specific version of gin-contrib/sessions that was being used, researching the known vulnerabilities associated with that version, and then upgrading to a version that does not have any known vulnerabilities.

The new version of gin-contrib/sessions was then integrated into the codebase, ensuring compatibility with the existing code. The application was thoroughly tested to ensure that it functions correctly with the updated dependency.

Going forward, it is recommended to monitor for any new vulnerabilities and regularly update dependencies to address them. This will help to maintain the security and integrity of the application.

References​

Last updated on