PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2020-16250] Unexpected security footguns in Go's parsers

blog.trailofbits.com | blog | CVE-2020-16250 | #authentication-bypass | #deserialization | #go | #json | #xml | #yaml | #parsers | #cve-2020-16250
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Unexpected behaviors in Go's JSON, XML, and YAML parsers let attackers bypass authentication, evade authorization, and exfiltrate data—seen in HashiCorp Vault's CVE-2020-16250 and real engagements.
CVE
CVE-2020-16250
Published
Collected

Related coverage

vulnerability · projectzero.google
[CVE-2020-16250] Enter the Vault: Authentication Issues in HashiCorp Vault
In this blog post I'll discuss two vulnerabilities in HashiCorp Vault and its integration with Amazon Web Services (AWS) and Google Cloud Platform (GCP). These issues can lead to an authentication bypass in configurations that use the aws and gcp auth methods, and demonstrate the type of issues you can find in modern “cloud-native” software. Both vulnerabilities (CVE-2020-16250/16251) were addressed by HashiCorp and are fixed in Vault versions 1.2.5, 1.3.8, 1.4.4 and 1.5.1 released in August.
blog · blog.trailofbits.com
Graphtage: A New Semantic Diffing Tool
Graphtage is a semantic diff tool for tree-structured files such as JSON, XML, and YAML: unlike line-oriented diff, it matches unordered structures and even compares across formats.
blog · netspi.com
Exploiting XPath Injection Weaknesses
A technical walkthrough of XPath injection: how unvalidated input in XML queries enables authentication bypass and data theft, with a vulnerable lab and Burp Suite techniques for identifying the flaw.
blog · netspi.com
Playing with Content-Type – XXE on JSON Endpoints
By switching a JSON request's Content-Type to application/xml, testers can sometimes reach an unanticipated XML parser on the server and trigger XXE, enabling file reads, UNC access, or SSRF.
vulnerability · blog.viettelcybersecurity.com
CVE-2026-33112: SharePoint XmlValidator Bypass Enables Low-Privilege RCE
CVE-2026-33112: a network-imported XSD schema bypasses SharePoint's XmlValidator, and the PerformancePoint PPSAuthoringService revives ExcelDataSet deserialization for low-privilege RCE.
blog · blog.trailofbits.com
SAML: A fractal of bad design
Trail of Bits traces SAML's committee-driven origins and argues the 2002 XML-based SSO protocol should finally be retired: cursed XML signature validation keeps producing vulnerabilities, and OIDC is the way forward.
Back