Listen to this Post
How the CVE Works
The vulnerability exists in the library’s feature for downloading a specific subdirectory from a remote source, such as a Git repository. When extracting the downloaded content to a local target directory, the library improperly handles symbolic links (symlinks) that may be present within the source. If a malicious actor plants a symlink in the source repository—for example, a link pointing to a sensitive system file like /etc/passwd—the go-getter library will follow this link during the copy operation. Instead of copying the link itself, it dereferences the link and copies the file it points to. This allows an attacker to force the application to read any file on the server’s filesystem that the application process has permission to access. The final result is the exfiltration of unauthorized data, as sensitive files are written into the intended, non-sensitive download destination where they can be read.
dailycve form
Platform: HashiCorp go-getter
Version: Up to 1.7.8
Vulnerability: Symlink attack
Severity: HIGH (7.5)
date: 2025-08-15
Prediction: 2025-08-15 (Patched)
What Undercode Say
Check go-getter version in your Go module grep "github.com/hashicorp/go-getter" go.mod Check for indirect dependencies go list -m all | grep go-getter Upgrade to the fixed version go get github.com/hashicorp/[email protected] go mod tidy
How Exploit
- Create a malicious repository containing a symbolic link to a targeted sensitive file (e.g.,
ln -s /etc/shadow ./link). - Host this repository on a public or controlled server.
- Trick a target application using a vulnerable version of go-getter into fetching a subdirectory from the malicious repository URL.
- The library downloads and extracts the content, following the symlink and copying the sensitive file into the application’s local directory.
- The attacker retrieves the extracted sensitive file from the application’s context.
Protection from this CVE
Upgrade the `github.com/hashicorp/go-getter` library to version 1.7.9 or later. Review and rebuild any applications, containers, or derived packages (like Terraform or Terragrunt) that depend on this library to ensure the fixed version is used.
Impact
Unauthorized read access to sensitive files on the host filesystem, leading to a loss of confidentiality. Successful exploitation could expose passwords, configuration secrets, or other critical system data.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
