CVE-2020-24553: 
Go vulnerability analysis and mitigation

Go before versions 1.14.8 and 1.15.x before 1.15.1 contains a Cross-Site Scripting (XSS) vulnerability in its CGI and FastCGI handlers. The vulnerability exists because text/html is set as the default Content-Type for handlers that lack a Content-Type header, contrary to the documented behavior of content-type auto-detection (NVD, RedTeam Advisory).

The vulnerability stems from an inconsistency between the documented behavior and actual implementation in Go's CGI and FastCGI transports. While the ResponseWriter interface documentation specifies that content type should be automatically detected from the first 512 bytes of data, the CGI and FastCGI implementations always set the Content-Type to 'text/html; charset=utf-8' when no content type is specified. This behavior differs from the HTTP server implementation which correctly performs content type detection. The vulnerability has been assigned a CVSS v3.1 base score of 6.1 MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) (NVD, RedTeam Advisory).

The vulnerability can lead to cross-site scripting attacks even when file upload validation is in place. For example, if an application allows uploading of PDF or PNG files and relies on auto-detection of content type, an attacker could upload a PNG file containing JavaScript in its comment field. When served through CGI/FastCGI, this file would be interpreted as HTML, executing the embedded JavaScript code in users' browsers (RedTeam Advisory).

The vulnerability is exploitable when applications depend on the documented behavior and are accessed via CGI or FastCGI. An attacker needs to be able to upload or provide content that will be served by the application. Proof-of-concept code demonstrating the vulnerability has been published, showing how a specially crafted PNG file with embedded JavaScript can be used to execute arbitrary code in users' browsers (RedTeam Advisory, Packet Storm).

The vulnerability has been fixed in Go versions 1.14.8 and 1.15.1. As a workaround, applications should explicitly set the Content-Type via the Header().Set() method of the ResponseWriter interface instead of relying on auto-detection. For example: w.Header().Set('Content-Type', 'image/png') before calling w.Write() (RedTeam Advisory).

Multiple organizations have released security advisories and patches in response to this vulnerability, including Oracle, SUSE, and NetApp. The vulnerability has been incorporated into security updates for various Linux distributions and enterprise software products (Oracle Alert, SUSE Update, NetApp Advisory).