#VU95528 Insufficient verification of data authenticity in go-getter - CVE-2024-6257
Published: August 8, 2024
Vulnerability identifier: #VU95528
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2024-6257
CWE-ID: CWE-345
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerable software:
go-getter
go-getter
Software vendor:
HashiCorp
HashiCorp
Description
The vulnerability allows a local user to compromise the affected system.
The vulnerability exists due to the way the Git config is handled by the library. When go-getter is performing a Git operation, go-getter will try to clone the given repository in a specified destination. Cloning initializes a git config to the provided destination and if the repository needs to get updated go-getter will pull the new changes. An attacker may alter the Git config after the cloning step to set an arbitrary Git configuration to achieve code execution.
Remediation
Install updates from vendor's website.