Insufficient verification of data authenticity in go-getter - CVE-2024-6257

Detailed vulnerability description

The vulnerability allows a local user to compromise the affected system.

The vulnerability exists due to the way the Git config is handled by the library. When go-getter is performing a Git operation, go-getter will try to clone the given repository in a specified destination. Cloning initializes a git config to the provided destination and if the repository needs to get updated go-getter will pull the new changes. An attacker may alter the Git config after the cloning step to set an arbitrary Git configuration to achieve code execution.

How to mitigate CVE-2024-6257

Sources

• https://discuss.hashicorp.com/t/hcsec-2024-13-hashicorp-go-getter-vulnerable-to-code-execution-on-git-update-via-git-config-manipulation/68081