CVE-2025-47912

package main import ( "fmt" "net/url" ) func main() { // PoC: IPv4 address in square brackets (RFC violation) maliciousURLs := []string{ "http://[192.168.1.1]/admin", "http://[10.0.0.1]:8080/login", "http://[example.com]/phishing", "http://[internal.corp]/secret", } fmt.Println("=== CVE-2025-47912 PoC ===") fmt.Println("Go Parse function accepts non-IPv6 values in square brackets") fmt.Println() for _, rawURL := range maliciousURLs { parsed, err := url.Parse(rawURL) if err != nil { fmt.Printf("Parse Error for %s: %v\n", rawURL, err) continue } fmt.Printf("Input: %s\n", rawURL) fmt.Printf("Host: %s\n", parsed.Host) fmt.Printf("Path: %s\n", parsed.Path) fmt.Printf("Scheme: %s\n", parsed.Scheme) fmt.Println("---") } fmt.Println("\nThese URLs violate RFC 3986 but are incorrectly accepted.") fmt.Println("IPv4 addresses and hostnames must NOT be in square brackets.") } /* Vulnerability Explanation: - RFC 3986 Section 3.2.2 states that IPv6 addresses are the ONLY valid content for square brackets in the host component. - Go's url.Parse() fails to enforce this restriction. - Attackers can craft malicious URLs to bypass security checks. Impact: - URL whitelist bypass - Security filter evasion - Potential SSRF in vulnerable applications */

{"cve": {"id": "CVE-2025-47912", "sourceIdentifier": "[email protected]", "published": "2025-10-29T23:16:18.187", "lastModified": "2026-01-29T13:57:18.690", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: \"http://[::1]/\". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.24.8", "matchCriteriaId": "E1AB9501-4F7D-4E37-BA0A-4E57B082530C"}, {"vulnerable": true, "criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.25.0", "versionEndExcluding": "1.25.2", "matchCriteriaId": "C196D175-EF20-476C-8C64-1B9F5C50AA2D"}]}]}], "references": [{"url": "https://go.dev/cl/709857", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://go.dev/issue/75678", "source": "[email protected]", "tags": ["Issue Tracking"]}, {"url": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI", "source": "[email protected]", "tags": ["Mailing List", "Release Notes"]}, {"url": "https://pkg.go.dev/vuln/GO-2025-4010", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "http://www.openwall.com/lists/oss-security/2025/10/08/1", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Release Notes"]}]}}