Security readout for executives and security teams
Plain-English summary
This flaw affects Go services using golang.org/x/crypto/acme/autocert on Windows. A crafted ACME HTTP-01 challenge path could make the service read files outside its cache directory, but only files with a specific added suffix. The business risk is information disclosure, not takeover or outage.
Executive priority
Prioritize remediation for internet-facing Windows Go services that automate ACME certificates with autocert. Treat other environments as lower urgency until dependency and platform exposure are confirmed. This is a targeted confidentiality risk, not broad infrastructure compromise based on the supplied evidence.
Technical view
The vulnerable cache key logic used path.Base instead of Windows-aware filepath.Base. On Windows, backslash-separated relative paths could survive token extraction, then be joined with the DirCache directory and opened after appending +http-01. The suffix requirement substantially limits arbitrary file read conditions.
Likely exposure
Exposure is likely limited to Windows deployments that use golang.org/x/crypto/acme/autocert with DirCache for ACME HTTP-01 certificate automation. The source bundle does not establish exposure for Linux, macOS, or unrelated Go crypto packages.
Exploitation context
The bundle lists no CISA KEV entry and provides no evidence of active exploitation. The CVSS vector indicates remote, unauthenticated, low-complexity access with confidentiality impact only. Practical impact depends on Windows use, DirCache configuration, service privileges, and whether sensitive files matching the required suffix exist.
Researcher notes
Key uncertainty is versioning: the bundle identifies the package and an affected version value of "0" but does not provide a conventional affected range. Ground validation in GO-2024-2961, the Go issue, and the linked code change. Avoid assuming exploit prevalence or impact beyond suffix-constrained file read.
Mitigation direction
- Check Go vulnerability guidance for GO-2024-2961 and apply the vendor-recommended update.
- Inventory Windows services using golang.org/x/crypto/acme/autocert DirCache.
- Run the affected service with least-privilege filesystem access.
- Restrict cache directory permissions to required service operations only.
- Monitor ACME challenge traffic and logs for suspicious malformed challenge paths.
Validation and detection
- Review go.mod, go.sum, and SBOMs for golang.org/x/crypto/acme/autocert usage.
- Confirm whether any affected service runs on Windows with DirCache enabled.
- Use Go vulnerability scanning mapped to GO-2024-2961 and CVE-2022-30636.
- Review service logs for malformed ACME HTTP-01 challenge requests.
- Assess whether sensitive files with the required suffix are readable by the service.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Credential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2022-30636 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N3.93.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://go.dev/cl/408694CVE reference
- https://go.dev/issue/53082CVE reference
- https://pkg.go.dev/vuln/GO-2024-2961CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.