CVE-2024-24789: Golang Go Archive/Zip File Vulnerability

CVE-2024-24789 Overview

CVE-2024-24789 is an Input Validation Error vulnerability in Go's archive/zip package that causes inconsistent handling of certain types of invalid zip files compared to most other zip implementations. This misalignment in parsing behavior can be exploited to create specially crafted zip files with contents that vary depending on which implementation reads the file. The Go archive/zip package has been updated to reject files containing these errors.

Critical Impact

Attackers can craft malicious zip files that appear benign to one zip implementation while containing different or malicious content when parsed by Go applications, potentially enabling security control bypasses and supply chain attacks.

Affected Products

• Golang Go (multiple versions)

Discovery Timeline

• 2024-06-05 - CVE CVE-2024-24789 published to NVD
• 2025-01-31 - Last updated in NVD database

Technical Details for CVE-2024-24789

Vulnerability Analysis

This vulnerability exists in Go's archive/zip package where the handling of certain malformed or invalid zip files differs from the behavior expected by most zip implementations. The core issue is a parsing discrepancy that allows attackers to create zip archives with ambiguous content—files that appear differently depending on which zip implementation processes them.

This type of inconsistency is particularly dangerous in security contexts where zip files may pass through multiple processing stages. For example, a malicious zip file might appear benign when scanned by security tools using one zip implementation, but reveal different (potentially malicious) contents when extracted by a Go application. This creates opportunities for attackers to bypass security controls, deliver malware, or manipulate data in supply chain scenarios.

The vulnerability has a local attack vector requiring user interaction or local access to process the malicious zip file through a vulnerable Go application.

Root Cause

The root cause stems from the archive/zip package's non-standard handling of certain error conditions in zip file structures. When encountering invalid or malformed zip file components, the Go implementation would process these files differently than other common zip implementations (such as those in operating systems or other programming languages). This behavioral divergence creates a parsing ambiguity that can be weaponized by attackers.

Attack Vector

The attack vector involves crafting a zip file that exploits the parsing differences between Go's archive/zip package and other zip implementations. An attacker would:

1. Create a specially crafted zip file containing structural anomalies or errors
2. Design the file so that standard zip implementations interpret it one way (potentially passing security checks)
3. Ensure Go's archive/zip package interprets the same file differently, extracting alternate or malicious content

The vulnerability requires local access to deliver the malicious zip file to a system running a vulnerable Go application that processes zip archives. The vulnerability can result in high integrity impact through content manipulation, though confidentiality and availability impacts are limited.

Detection Methods for CVE-2024-24789

Indicators of Compromise

• Presence of zip files with unusual structural anomalies or malformed headers being processed by Go applications
• Discrepancies between expected and actual extracted file contents from zip archives
• Log entries indicating zip parsing errors followed by successful extraction in Go applications
• Files extracted from zip archives that don't match hash values or signatures of expected contents

Detection Strategies

• Monitor Go applications that process zip files for unusual behavior or unexpected file extractions
• Implement integrity checking to verify extracted zip contents match expected values
• Use multiple zip implementations to cross-verify archive contents before processing
• Deploy application-level logging for all zip file processing operations in Go applications

Monitoring Recommendations

• Enable verbose logging for Go applications handling zip file operations
• Monitor for anomalies in file extraction patterns and content integrity
• Implement alerting for zip parsing errors or warnings in application logs
• Track and inventory all Go applications in your environment that process zip archives

How to Mitigate CVE-2024-24789

Immediate Actions Required

• Update Go to the latest patched version that includes the fix for CVE-2024-24789
• Audit all Go applications that use the archive/zip package for zip file processing
• Implement additional validation of zip file contents after extraction
• Consider implementing content verification using checksums or signatures

Patch Information

The Go development team has released patches to address this vulnerability. The archive/zip package now properly rejects files containing the structural errors that caused the parsing inconsistency. For detailed patch information, refer to the Go.dev CL 585397 Details and the Go.dev Issue 66869 Report. Additional vulnerability details are available at the Go Vulnerability GO-2024-2888 page.

Workarounds

• Implement pre-processing validation of zip files using multiple zip implementations before Go processing
• Add integrity verification layers to validate extracted content against known-good hashes
• Restrict zip file processing to trusted sources only until patches can be applied
• Consider using alternative archive formats where zip parsing consistency is critical to security

# Verify Go version and check for vulnerability
go version

# Update Go to latest patched version
# Download from https://go.dev/dl/

# List dependencies using archive/zip in your project
go list -m all | grep -i archive