CVE-2024-45340

CVE-2024-45340 affects the Go command line tool's GOAUTH feature, introduced in Go 1.24. The feature did not properly segment credentials by domain, meaning that a credential stored in the user's .netrc file for one domain could be exposed to a different domain [1][3].

An attacker can exploit this by setting up a malicious server that, when the Go tool fetches modules or performs authentication, triggers a request for credentials from a different domain. The Go tool then sends credentials intended for another domain, leaking them to the attacker [2]. No special privileges are required other than the ability to serve a resource that triggers the Go tool's authentication flow.

The impact is that an attacker can obtain credentials stored in the user's .netrc file, which may include passwords or tokens for various services, leading to unauthorized access to accounts and resources [3]. The severity is rated High with a CVSS score of 8.8.

The vulnerability is fixed in Go 1.24rc2 and later. Users are advised to update to the latest release. By default, only credentials from .netrc are affected unless other credential sources are configured [1].