CVE-2024-6257 HashiCorp go-getter Vulnerable to Code Execution On Git Update Via Git Config Manipulation

What is CVE-2024-6257?

CVE-2024-6257 is a high-severity command injection vulnerability in HashiCorp Shared library, published on 25 Jun 2024. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to arbitrary code execution.

Weakness: CWE-77

Which versions are affected by CVE-2024-6257?

3 open source packages ship an affected version, including github.com/hashicorp/go-getter. It affects 1 product.

Products include Hashicorp Go-Getter.

How do I fix CVE-2024-6257?

Upgrade github.com/hashicorp/go-getter to 1.7.5 or later.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2024-6257 being exploited?

There is no known exploitation of CVE-2024-6257 in the wild and no public exploit code.

Other vulnerabilities in HashiCorp Shared library

• CVE-2024-3817 HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches Critical 9.8
• CVE-2022-26945 Server-side request forgery in n/a Critical 9.8
• CVE-2022-30321 Path traversal in n/a High 8.6
• CVE-2022-30322 Denial of service in n/a High 8.6
• CVE-2022-30323 Denial of service in n/a High 8.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-42982, BELL-CVE-2024-6257, DEBIAN-CVE-2024-6257, GHSA-xfhp-jf8p-mh5w, GO-2024-2948, ROOT-APP-GOBINARY-CVE-2024-6257 and 3 more.