QID 980673

QID 980673: Go (go) Security Update for github.com/elves/elvish (GHSA-fpv6-f8jw-rc3r)

Security update has been released for github.com/elves/elvish to fix the vulnerability.

Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.

Elvish's backend for the experimental web UI (started by `elvish -web`) hosts an endpoint that allows executing the code sent from the web UI.

The backend does not check the origin of requests correctly. As a result, if the user has the web UI backend open and visits a compromised or malicious website, the website can send arbitrary code to the endpoint in localhost.

CVSS V3 rated as Critical - 8.8 severity.

CVSS V2 rated as Critical - 9.3 severity.

Solution

All Elvish releases since 0.14.0 no longer include the experimental web UI, although it is still possible for the user to build a version from source that includes it.

The issue can be patched for previous versions by removing the web UI (found in web, pkg/web or pkg/prog/web, depending on the exact version).Workaround:
Do not use the experimental web UI.

Vendor References

GHSA-fpv6-f8jw-rc3r - github.com/advisories/GHSA-fpv6-f8jw-rc3r

CVEs related to QID 980673

CVE-2021-41088 |

Software Advisories

Advisory ID	Software	Component	Link
GHSA-fpv6-f8jw-rc3r	github.com/elves/elvish		github.com/advisories/GHSA-fpv6-f8jw-rc3r

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].