Detections
Analytics

Golang Expvar Information Disclosure

medium Web App Scanning Plugin ID 115465

Synopsis

Golang Expvar Information Disclosure

Description

The Golang standard library provides the 'expvar' package, which exposes application variables through a JSON endpoint registered by default on '/debug/vars'. Beside the custom variables published by the application, the package always exposes the 'cmdline' variable, which contains the command line and the arguments used to start the process, and the 'memstats' variable, which contains the runtime memory allocator statistics. When publicly exposed, a remote and unauthenticated attacker could leverage these information to disclose the binary path, the command line arguments, which may contain credentials or secrets, and to gain knowledge about the internal state of the target application in order to conduct further attacks.

Solution

Ensure that the detected 'expvar' endpoint is not publicly available by removing its registration from the production builds, requiring authentication or applying IP source filtering.

See Also

https://pkg.go.dev/expvar

Plugin Details

Severity: Medium

ID: 115465

Type: Check Based

Published: 9/8/2026

Updated: 9/8/2026

Scan Template: api, basic, full, pci, scan

Risk Information

CVSS v2

Risk Factor: Medium

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: Tenable

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS Score Source: Tenable

CVSS v4

Risk Factor: Medium

Base Score: 6.9

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS Score Source: Tenable

Reference Information