Researchers from the Israeli cybersecurity firm Oxeye have reported on a new parameter smuggling vulnerability known as “ParseThru”. This vulnerability affects Golang-based APIs, which could be exploited by threat actors to bypass validations and gain unauthorized access to vulnerable cloud applications. The flaw was caused by a recent behavioral change implemented in Golang’s URL parsing logic in builds 1.17 and later which conflicts with Golang applications running older versions of the framework. In previous versions of Golang, a semicolon (“;”) character was utilized as a delimiter, breaking up URLs to yield multiple query parameters. However, in versions 1.17 and later, the semicolon is no longer valid and causes the “parseQuery” method to return an error. In Oxeye’s case studies, this vulnerability can be exploited when two Golang-based applications that handle semicolons differently interact with one another. For example, a user-facing application running version 1.17 could send a malicious request containing semicolons to a backend service running a version prior to 1.17. In this scenario, the semicolons would be ignored by the public-facing API and processed by the backend service without the semicolon. Once the validations are bypassed, the attackers would be able to further carry out unauthorized activity. CTIX analysts recommend that any administrators responsible for Golang-based applications and services upgrade to the latest secure version. If the entire Golang environment cannot be updated immediately due to business needs, then administrators should sanitize the raw query so that any invalid input of a semicolon is rejected before the method call.