The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response is large, this can cause excessive CPU consumption.
CVSS Details
CVSS Score
5.3
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Configurations (Affected Products)
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* - VULNERABLE
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* - VULNERABLE
Go < 1.23.x (待确认具体版本)
Go < 1.22.x (待确认具体版本)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
package main
import (
"fmt"
"strings"
)
// Vulnerable function - simulates Reader.ReadResponse
func ReadResponseVulnerable(lineCount int) string {
result := ""
for i := 0; i < lineCount; i++ {
result += fmt.Sprintf("line%d: data\n", i) // Inefficient concatenation
}
return result
}
// Fixed function - uses strings.Builder
func ReadResponseFixed(lineCount int) string {
var builder strings.Builder
for i := 0; i < lineCount; i++ {
builder.WriteString(fmt.Sprintf("line%d: data\n", i))
}
return builder.String()
}
func main() {
lineCount := 100000 // Large number of lines
fmt.Printf("Testing with %d lines\n", lineCount)
// Vulnerable version - high CPU usage
resultV := ReadResponseVulnerable(lineCount)
fmt.Printf("Vulnerable version completed, length: %d\n", len(resultV))
// Fixed version - efficient
resultF := ReadResponseFixed(lineCount)
fmt.Printf("Fixed version completed, length: %d\n", len(resultF))
}
// Attack scenario:
// 1. Attacker controls data source or performs MITM attack
// 2. Attacker sends response with 100,000+ lines
// 3. Target application calls ReadResponse()
// 4. O(n²) string concatenation causes CPU spike
// 5. Service becomes unresponsive or crashes