GHSA-f6mm-5fc7-3g3c goreleaser shows environment by default

Not scored Published 15 May 2024

Goreleaser leaks environment variables containing secrets in log output when Go build commands produce non-empty output.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is GHSA-f6mm-5fc7-3g3c?

GHSA-f6mm-5fc7-3g3c is a vulnerability in github.com/goreleaser/goreleaser, published on 15 May 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Summary

Since #4787 the log output is printed on the INFO level, while previously it was logged on DEBUG. This means if the go build output is non-empty, goreleaser leaks the environment.

PoC

Create a Go project with dependencies, do not pull them yet (or run goreleaser later in a container, or delete $GOPATH/pkg).
Make sure to have secrets set in the environment
Make sure to not have go mod tidy in a before hook
Run goreleaser release --clean
Go prints lots of go: downloading ... lines, which triggers the "if output not empty, log it" line, which includes the environment.

Impact

Credentials and tokens are leaked.

Which versions are affected by GHSA-f6mm-5fc7-3g3c?

3 open source packages ship an affected version, including github.com/goreleaser/goreleaser.

Package	Affected	Fixed in
`github.com/goreleaser/goreleaser` Go	From `1.26.0`	`1.26.1`
`github.com/goreleaser/goreleaser` Go	From `1.26.0`	`1.26.1`
`github.com/goreleaser/goreleaser` Go	From `1.26.0`	`1.26.1`

How do I fix GHSA-f6mm-5fc7-3g3c?

Upgrade github.com/goreleaser/goreleaser to 1.26.1 or later.

Is GHSA-f6mm-5fc7-3g3c being exploited?

There is no known exploitation of GHSA-f6mm-5fc7-3g3c in the wild and no public exploit code.

Sources

Also known as GO-2024-2860.