GHSA-CPWG-X64R-RGWG

Vulnerability from github – Published: 2026-06-12 18:29 – Updated: 2026-06-12 18:29
VLAI
Summary
gorest InMemorySecret2FA race condition allows process crash via concurrent map access (CWE-362)
Details

Vulnerability: CWE-362 — Concurrent Map Access Race Condition in InMemorySecret2FA

CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization)

Affected Component

  • github.com/pilinux/gorest — Go REST API boilerplate
  • InMemorySecret2FA — in-memory 2FA secret store

Vulnerability Locations

File Line Role
database/model/twoFA.go 43 Global map[uint64]Secret2FA — bare map, no sync.RWMutex
handler/login.go 139 Map write during user login
handler/twoFA.go 205 Map write during 2FA setup
handler/twoFA.go 272 Map write during 2FA activation
handler/twoFA.go 575 Map write during 2FA verification
handler/twoFA.go 189 Map read during 2FA operations
handler/twoFA.go 245 Map read during 2FA operations
handler/twoFA.go 491 Map read during 2FA operations
service/common.go 79 Map delete

Data Flow

Multiple HTTP goroutines (concurrent requests)
    │
    ├── handler/login.go:139 ─► map write ──┐
    ├── handler/twoFA.go:205 ─► map write ──┼── InMemorySecret2FA (bare map)
    ├── handler/twoFA.go:189 ─► map read ───┤      ▲  NO sync.RWMutex
    ├── handler/twoFA.go:245 ─► map read ───┤      │
    ├── handler/twoFA.go:491 ─► map read ───┤      │
    └── service/common.go:79 ─► map delete ─┘      │
                                                   │
            Go runtime detects concurrent map      │
            read+write or write+write              │
                │                                  │
                ▼                                  │
    fatal error: concurrent map read and map write │
    fatal error: concurrent map writes             │
                │                                  │
                ▼                                  │
         Process crash (DoS) ──────────────────────┘

Description

The InMemorySecret2FA in database/model/twoFA.go was defined as a package-level map[uint64]Secret2FA — a bare Go map with no synchronization primitive. Multiple HTTP handlers in handler/login.go and handler/twoFA.go read from and wrote to this map concurrently. Go's runtime detects unsynchronized concurrent map access and throws an unrecoverable fatal error, which crashes the entire process.

This is a CWE-362 race condition: the shared resource (the map) is accessed concurrently without proper synchronization, and the failure mode is a hard process crash (denial of service).

Trigger Conditions

  1. Two users with 2FA enabled logging in simultaneously — concurrent map writes
  2. One user logging in (map write) while another performs 2FA verification (map read)
  3. Any concurrent combination of the 9 affected handler locations

Proof of Concept

# Simulate two concurrent logins with 2FA enabled
for i in 1 2; do
    curl -X POST http://target:8080/api/v1/login         -H "Content-Type: application/json"         -d "{"email":"user${i}@example.com","password":"testpass"}" &
done
wait

# Go runtime output:
# fatal error: concurrent map writes
# goroutine 34 [running]:
# runtime.throw({0x...})
#   runtime/map.go:...

Impact

  • Availability (High): Hard process crash via Go runtime fatal error. No recovery possible — the process exits. An attacker can repeat the concurrent requests to crash the service on demand.
  • Confidentiality (None): The crash itself does not leak data.
  • Integrity (None): No data corruption (Go prevents it by crashing).

Fix (PR #391)

Introduced Secret2FAStore struct with sync.RWMutex protection:

// BEFORE: database/model/twoFA.go — bare map, no protection
var InMemorySecret2FA map[uint64]Secret2FA

// AFTER: Wrapped with sync.RWMutex
type Secret2FAStore struct {
    mu   sync.RWMutex
    data map[uint64]Secret2FA
}

func (s *Secret2FAStore) Get(key uint64) (Secret2FA, bool) {
    s.mu.RLock()
    defer s.mu.RUnlock()
    v, ok := s.data[key]
    return cloneSecret2FA(v), ok
}

func (s *Secret2FAStore) Set(key uint64, value Secret2FA) {
    s.mu.Lock()
    defer s.mu.Unlock()
    s.data[key] = cloneSecret2FA(value)
}

func (s *Secret2FAStore) Delete(key uint64) {
    s.mu.Lock()
    defer s.mu.Unlock()
    delete(s.data, key)
}

// cloneSecret2FA returns a deep copy of a Secret2FA.
// This prevents external code from mutating the store's data
// through shared slice backing arrays.
func cloneSecret2FA(v Secret2FA) Secret2FA {
    out := Secret2FA{Image: v.Image}
    if v.PassHash != nil {
        out.PassHash = append([]byte(nil), v.PassHash...)
    }
    if v.KeySalt != nil {
        out.KeySalt = append([]byte(nil), v.KeySalt...)
    }
    if v.Secret != nil {
        out.Secret = append([]byte(nil), v.Secret...)
    }
    return out
}

All 9 handler call sites updated from direct map access to store method calls.

Not Vulnerable (verified during audit)

  • JWT: RSA keys from files, appleboy/gin-jwt middleware — correct
  • Password hashing: Argon2 via pilinux/argon2 — correct
  • SQL queries: GORM parameterized — correct
  • CORS: validates wildcard+credentials combination at config load — correct

Patched Versions

All versions after PR #391 merge.

Resources

  • Fix PR: https://github.com/pilinux/gorest/pull/391

Credit

Reported by @saaa99999999 via manual security audit.

Severity
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.12.1"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/pilinux/gorest"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.12.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-48154"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-362"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-12T18:29:08Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Vulnerability: CWE-362 \u2014 Concurrent Map Access Race Condition in InMemorySecret2FA\n\n**CWE:** CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization)\n\n### Affected Component\n- `github.com/pilinux/gorest` \u2014 Go REST API boilerplate\n- InMemorySecret2FA \u2014 in-memory 2FA secret store\n\n### Vulnerability Locations\n\n| File | Line | Role |\n|------|------|------|\n| `database/model/twoFA.go` | 43 | Global `map[uint64]Secret2FA` \u2014 bare map, no sync.RWMutex |\n| `handler/login.go` | 139 | Map write during user login |\n| `handler/twoFA.go` | 205 | Map write during 2FA setup |\n| `handler/twoFA.go` | 272 | Map write during 2FA activation |\n| `handler/twoFA.go` | 575 | Map write during 2FA verification |\n| `handler/twoFA.go` | 189 | Map read during 2FA operations |\n| `handler/twoFA.go` | 245 | Map read during 2FA operations |\n| `handler/twoFA.go` | 491 | Map read during 2FA operations |\n| `service/common.go` | 79 | Map delete |\n\n### Data Flow\n\n```\nMultiple HTTP goroutines (concurrent requests)\n    \u2502\n    \u251c\u2500\u2500 handler/login.go:139 \u2500\u25ba map write \u2500\u2500\u2510\n    \u251c\u2500\u2500 handler/twoFA.go:205 \u2500\u25ba map write \u2500\u2500\u253c\u2500\u2500 InMemorySecret2FA (bare map)\n    \u251c\u2500\u2500 handler/twoFA.go:189 \u2500\u25ba map read \u2500\u2500\u2500\u2524      \u25b2  NO sync.RWMutex\n    \u251c\u2500\u2500 handler/twoFA.go:245 \u2500\u25ba map read \u2500\u2500\u2500\u2524      \u2502\n    \u251c\u2500\u2500 handler/twoFA.go:491 \u2500\u25ba map read \u2500\u2500\u2500\u2524      \u2502\n    \u2514\u2500\u2500 service/common.go:79 \u2500\u25ba map delete \u2500\u2518      \u2502\n                                                   \u2502\n            Go runtime detects concurrent map      \u2502\n            read+write or write+write              \u2502\n                \u2502                                  \u2502\n                \u25bc                                  \u2502\n    fatal error: concurrent map read and map write \u2502\n    fatal error: concurrent map writes             \u2502\n                \u2502                                  \u2502\n                \u25bc                                  \u2502\n         Process crash (DoS) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n```\n\n### Description\n\nThe `InMemorySecret2FA` in `database/model/twoFA.go` was defined as a package-level `map[uint64]Secret2FA` \u2014 a bare Go map with no synchronization primitive. Multiple HTTP handlers in `handler/login.go` and `handler/twoFA.go` read from and wrote to this map concurrently. Go\u0027s runtime detects unsynchronized concurrent map access and throws an unrecoverable `fatal error`, which crashes the entire process.\n\nThis is a CWE-362 race condition: the shared resource (the map) is accessed concurrently without proper synchronization, and the failure mode is a hard process crash (denial of service).\n\n### Trigger Conditions\n\n1. Two users with 2FA enabled logging in simultaneously \u2014 concurrent map writes\n2. One user logging in (map write) while another performs 2FA verification (map read)\n3. Any concurrent combination of the 9 affected handler locations\n\n### Proof of Concept\n\n```bash\n# Simulate two concurrent logins with 2FA enabled\nfor i in 1 2; do\n    curl -X POST http://target:8080/api/v1/login         -H \"Content-Type: application/json\"         -d \"{\"email\":\"user${i}@example.com\",\"password\":\"testpass\"}\" \u0026\ndone\nwait\n\n# Go runtime output:\n# fatal error: concurrent map writes\n# goroutine 34 [running]:\n# runtime.throw({0x...})\n#   runtime/map.go:...\n```\n\n### Impact\n\n- **Availability (High):** Hard process crash via Go runtime fatal error. No recovery possible \u2014 the process exits. An attacker can repeat the concurrent requests to crash the service on demand.\n- **Confidentiality (None):** The crash itself does not leak data.\n- **Integrity (None):** No data corruption (Go prevents it by crashing).\n\n### Fix (PR #391)\n\nIntroduced `Secret2FAStore` struct with `sync.RWMutex` protection:\n\n```go\n// BEFORE: database/model/twoFA.go \u2014 bare map, no protection\nvar InMemorySecret2FA map[uint64]Secret2FA\n\n// AFTER: Wrapped with sync.RWMutex\ntype Secret2FAStore struct {\n    mu   sync.RWMutex\n    data map[uint64]Secret2FA\n}\n\nfunc (s *Secret2FAStore) Get(key uint64) (Secret2FA, bool) {\n    s.mu.RLock()\n    defer s.mu.RUnlock()\n    v, ok := s.data[key]\n    return cloneSecret2FA(v), ok\n}\n\nfunc (s *Secret2FAStore) Set(key uint64, value Secret2FA) {\n    s.mu.Lock()\n    defer s.mu.Unlock()\n    s.data[key] = cloneSecret2FA(value)\n}\n\nfunc (s *Secret2FAStore) Delete(key uint64) {\n    s.mu.Lock()\n    defer s.mu.Unlock()\n    delete(s.data, key)\n}\n\n// cloneSecret2FA returns a deep copy of a Secret2FA.\n// This prevents external code from mutating the store\u0027s data\n// through shared slice backing arrays.\nfunc cloneSecret2FA(v Secret2FA) Secret2FA {\n\tout := Secret2FA{Image: v.Image}\n\tif v.PassHash != nil {\n\t\tout.PassHash = append([]byte(nil), v.PassHash...)\n\t}\n\tif v.KeySalt != nil {\n\t\tout.KeySalt = append([]byte(nil), v.KeySalt...)\n\t}\n\tif v.Secret != nil {\n\t\tout.Secret = append([]byte(nil), v.Secret...)\n\t}\n\treturn out\n}\n```\n\nAll 9 handler call sites updated from direct map access to store method calls.\n\n### Not Vulnerable (verified during audit)\n\n- JWT: RSA keys from files, appleboy/gin-jwt middleware \u2014 correct\n- Password hashing: Argon2 via pilinux/argon2 \u2014 correct\n- SQL queries: GORM parameterized \u2014 correct\n- CORS: validates wildcard+credentials combination at config load \u2014 correct\n\n### Patched Versions\n\nAll versions after PR #391 merge.\n\n### Resources\n\n- Fix PR: https://github.com/pilinux/gorest/pull/391\n\n### Credit\n\nReported by @saaa99999999 via manual security audit.",
  "id": "GHSA-cpwg-x64r-rgwg",
  "modified": "2026-06-12T18:29:08Z",
  "published": "2026-06-12T18:29:08Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pilinux/gorest/security/advisories/GHSA-cpwg-x64r-rgwg"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pilinux/gorest/pull/391"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pilinux/gorest"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "gorest InMemorySecret2FA race condition allows process crash via concurrent map access (CWE-362)"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.