CVE-2024-24787 PoC — Arbitrary code execution during build on Darwin in cmd/go

Source

https://github.com/LOURC0D3/CVE-2024-24787-PoC

Associated Vulnerability

Title: Arbitrary code execution during build on Darwin in cmd/go (CVE-2024-24787)
Description:On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_library flag in a "#cgo LDFLAGS" directive.

Description

CVE-2024-24787 Proof of Concept

Readme

# CVE-2024-24787-PoC

On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_library flag in a "#cgo LDFLAGS" directive.

![img](./result.png)

This is not my bug, I just made a PoC for it.

# Reference
  - [https://pkg.go.dev/vuln/GO-2024-2825](https://pkg.go.dev/vuln/GO-2024-2825)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →