[Go] Add Unicode Bypass Validation query, test and help file

[Sim4n6]

Query PR

github/codeql#12994

Language

GoLang

CVE(s) ID list

• CVE-2019-10160

CWE

CWE-176

Report

Please refer to the report in this issue: #749

Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc).

• Yes
• No

Blog post link

https://sim4n6.beehiiv.com

[jorgectf]

👋 @Sim4n6

Thank you for your contribution!

The CVE linked does not relate to the contribution itself, as the code in question is not Go. Could you provide a CVE that matches the contribution fully?

[Sim4n6]

Hey @jorgectf ,

I have got this one CVE-2023-52081 assigned. But the Source is not RFS but rather a CLI args. If you feel that it does not fit within the program policy, please let me know. I'll keep hunting for more :-)

[Sim4n6]

I still have a Go-related one in the pipeline. This time, the source is RFS. I'm not sure I would convince the maintainer since the report was submitted privately. But the discussion continues in a Discord channel.
I shall wait until after 01/01/2024 and by the way, happy new year to you all :-)

[Sim4n6]

I still have a Go-related one in the pipeline. This time, the source is RFS. I'm not sure I would convince the maintainer since the report was submitted privately. But the discussion continues in a Discord channel. I shall wait until after 01/01/2024 and by the way, happy new year to you all :-)

Negative.

[jorgectf]

👋 Hello @Sim4n6, what is the status of your progress? Were you able to get a CVE?

[Sim4n6]

No i did not get the CVE at the end. I would give it another and the last try this weekend please.

[Sim4n6]

I'll give it another try with MRVA

[Sim4n6]

I found something interesting "multiple passwords collision", for instance, the victim sets the following password passw0rd as a valid one, the attacker could provide paßw0rd or paˢˢw0rd or even passw⁰rd. But I believe this is more of a functionality bug than a security one. If it was on the username, it could lead to ATO.

Still investigating .. .

[Sim4n6]

Well, to make a situation update on this one.

1. Accepted and then closed https://github.com/ItalyPaleAle/prvt/security/advisories/GHSA-hg4j-748w-m644
2. Self-closed this one is low impact and more of a functional issue than a security one https://github.com/rclone/rclone/security/advisories/GHSA-884f-x559-4jm9
3. CVE-2023-52081 assigned and published but the Source is a CLI input and not RFS.

[Sim4n6]

I have at least two id on repos on github but did not yet enable the private vulnerability reporting feature to submit the report.. '

[ghsecuritylab]

Your submission is now in status Query review.

For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed