CVE-2023-45286: HTTP request body disclosure in github.com/go-resty/resty/v2

Vulnerability summary

CVE-2023-45286 is a medium (CVSS 5.9) vulnerability in github.com/go-resty/resty/v2. EPSS estimates a 0.72% chance of exploitation in the next 30 days, higher than 54% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 28-11-2023
   PublishedVulnerability first disclosed.
2. 28-08-2024
   Last modifiedVulnerability information updated.

Description

A race condition in go-resty can result in HTTP request body disclosure across requests. This condition can be triggered by calling sync.Pool.Put with the same *bytes.Buffer more than once, when request retries are enabled and a retry occurs. The call to sync.Pool.Get will then return a bytes.Buffer that hasn't had bytes.Buffer.Reset called on it. This dirty buffer will contain the HTTP request body from an unrelated request, and go-resty will append the current HTTP request body to it, sending two bodies in one request. The sync.Pool in question is defined at package level scope, so a completely unrelated server could receive the request body.

• CWE-362Concurrent Execution using Shared Resource with Improper SynchronizationThe product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.