CVE-2024-45340: Go GOAUTH Credential Disclosure Vulnerability

CVE-2024-45340 Overview

CVE-2024-45340 affects the Go toolchain's cmd/go command. The new GOAUTH feature failed to properly segment credentials by domain. A malicious server could request credentials it should not have access to. By default, this issue only affected credentials stored in the user's .netrc file unless GOAUTH was otherwise configured. The vulnerability is tracked upstream as GO-2025-3383.

Critical Impact
A malicious module server can harvest .netrc credentials belonging to unrelated domains during go command operations, exposing developer secrets and downstream systems.

Affected Products

Go toolchain cmd/go implementing the GOAUTH feature
Developer workstations using .netrc for module authentication
CI/CD pipelines resolving Go modules with GOAUTH configured

Discovery Timeline

2025-01-28 - CVE-2024-45340 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-45340

Vulnerability Analysis

The Go cmd/go GOAUTH mechanism supplies HTTP credentials when fetching modules from remote servers. The implementation did not correctly bind credentials to the domain they were issued for. When a module fetch contacted a hostile server, that server could induce the client to attach credentials intended for a different host. The result is a credential disclosure vulnerability affecting integrity and confidentiality of any secrets present in the user's .netrc file.

Exploitation requires the developer to invoke a go subcommand that triggers module resolution against an attacker-controlled endpoint. This is realistic in dependency confusion scenarios or when a compromised proxy sits in the module resolution path.

Root Cause

The root cause is missing domain scoping in the GOAUTH credential provider. Credentials read from .netrc were made available to authentication requests without validating that the requesting host matched the host the credential was defined for. This is an authorization boundary flaw in credential handling rather than a memory safety issue.

Attack Vector

The attack requires network positioning as a Go module server, or the ability to redirect resolution to one. Once contacted, the malicious server prompts GOAUTH for credentials associated with an arbitrary domain. The Go client returns credentials from .netrc for that domain even though the request originates from the attacker's host. See Go.dev Issue #71249 and the fix in Go.dev CL #643097 for the technical patch details.

Detection Methods for CVE-2024-45340

Indicators of Compromise

Outbound HTTPS requests from go processes to unexpected module hosts containing Authorization or Basic headers.
Module resolution errors or redirects pointing to hosts not listed in go.mod or GOPROXY.
Access logs on internal artifact repositories showing authentication attempts sourced from developer workstations after unrelated go get or go build activity.

Detection Strategies

Inspect network egress from build agents for go command traffic to domains outside the approved proxy allowlist.
Correlate go invocations with authenticated requests to hosts referenced in .netrc to identify credential exposure to unintended servers.
Alert on read access to ~/.netrc by go subprocesses immediately followed by connections to non-corporate domains.

Monitoring Recommendations

Enable verbose logging (GODEBUG=http2debug=1, -x flag) on CI runners to capture module fetch destinations and headers.
Forward developer endpoint process and network telemetry to a centralized data lake for retrospective hunting across historical builds.
Rotate any credentials stored in .netrc if hosts outside your approved proxy list appear in build logs.

How to Mitigate CVE-2024-45340

Immediate Actions Required

Upgrade the Go toolchain to a version containing the fix referenced in Go.dev CL #643097.
Audit .netrc files on developer workstations and build agents, and rotate any credentials that could have been exposed.
Restrict Go module resolution to a trusted internal GOPROXY and disable direct fetches with GOPROXY=<proxy>,direct replaced by GOPROXY=<proxy> where feasible.

Patch Information

The fix is delivered through the Go project and tracked as GO-2025-3383. Apply the patched Go release and rebuild any container images or CI runners that ship a bundled Go toolchain. Review the upstream discussion on Google Groups for context on the disclosure.

Workarounds

Unset or restrict GOAUTH and remove non-essential entries from .netrc on systems that build Go code.
Route all module fetches through an internal proxy such as Athens or a private Artifactory instance to prevent contact with untrusted hosts.
Use short-lived, scoped tokens instead of long-lived credentials in .netrc for repositories accessed by Go tooling.

bash

# Configuration example: constrain module resolution to a trusted proxy
export GOPROXY="https://proxy.internal.example.com"
export GOSUMDB="sum.internal.example.com"
export GOPRIVATE="git.internal.example.com"
unset GOAUTH
chmod 600 ~/.netrc