CVE-2024-6104: HashiCorp go-retryablehttp Info Disclosure

CVE-2024-6104 Overview

CVE-2024-6104 is a sensitive information exposure vulnerability in HashiCorp's go-retryablehttp library, a popular Go package used for HTTP requests with automatic retries. Prior to version 0.7.7, the library failed to sanitize URLs when writing them to its log file, potentially exposing sensitive HTTP basic authentication credentials in plaintext within log files.

Critical Impact

Applications using go-retryablehttp versions prior to 0.7.7 may inadvertently log HTTP basic authentication credentials, potentially exposing usernames and passwords to unauthorized parties with access to log files.

Affected Products

• HashiCorp go-retryablehttp versions prior to 0.7.7
• Applications and services built using vulnerable versions of go-retryablehttp
• HashiCorp products and third-party tools that depend on go-retryablehttp

Discovery Timeline

• 2024-06-24 - CVE-2024-6104 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-6104

Vulnerability Analysis

This vulnerability falls under CWE-532 (Insertion of Sensitive Information into Log File), a common security weakness where applications inadvertently write sensitive data to log files. The go-retryablehttp library provides HTTP client functionality with built-in retry logic, making it widely used in distributed systems and cloud infrastructure tooling.

When HTTP requests include basic authentication credentials embedded in the URL (in the format https://username:password@example.com/path), these credentials were written to log files without sanitization. This exposure occurs because the library logs the full URL during retry operations and error conditions without masking or removing the userinfo component of the URL.

The vulnerability requires local access to exploit, as an attacker would need to read the log files containing the exposed credentials. However, in shared hosting environments, containerized deployments, or scenarios where log aggregation services collect application logs, this could expand the attack surface significantly.

Root Cause

The root cause of CVE-2024-6104 lies in insufficient input sanitization within the logging functionality of go-retryablehttp. The library's logging mechanism directly writes request URLs to log files without first parsing and removing the userinfo (username:password) portion of the URL. According to RFC 3986, the userinfo subcomponent of a URL authority may contain sensitive authentication credentials that should not be exposed in logs or other persistent storage mechanisms.

Attack Vector

The attack vector for this vulnerability is local, requiring an attacker to have access to the system where the vulnerable application's logs are stored. Exploitation scenarios include:

An attacker with read access to log files on the affected system can extract HTTP basic authentication credentials that were logged during retry operations. This is particularly concerning in multi-tenant environments, shared hosting platforms, or when log files are inadvertently exposed through misconfigured log aggregation services.

The vulnerability does not require user interaction and can be exploited by any process or user with read permissions on the log files. The impact is limited to confidentiality, as the exposed credentials could be used to authenticate to the target services.

Detection Methods for CVE-2024-6104

Indicators of Compromise

• Presence of URLs containing userinfo components (username:password@) in application log files
• Log entries from go-retryablehttp containing HTTP basic auth credentials in plaintext
• Unexpected access patterns to log files or log directories
• Authentication attempts from unusual sources using credentials that were only used in go-retryablehttp requests

Detection Strategies

• Audit application dependencies to identify use of go-retryablehttp versions prior to 0.7.7
• Implement log file scanning to detect patterns matching URL-embedded credentials (regex patterns for ://[^:]+:[^@]+@)
• Monitor file access events on log directories for suspicious read operations
• Review dependency manifests (go.mod, go.sum) across your codebase for vulnerable versions

Monitoring Recommendations

• Configure SentinelOne agents to monitor for sensitive data patterns in log files
• Implement centralized log analysis to detect credential exposure across all applications
• Set up alerts for unusual log file access patterns or bulk log file reads
• Monitor for authentication attempts using credentials that may have been exposed through logged URLs

How to Mitigate CVE-2024-6104

Immediate Actions Required

• Upgrade go-retryablehttp to version 0.7.7 or later immediately
• Audit existing log files for exposed credentials and rotate any potentially compromised credentials
• Review applications using go-retryablehttp and assess exposure risk
• Implement log file access controls to limit who can read application logs

Patch Information

HashiCorp has addressed this vulnerability in go-retryablehttp version 0.7.7. The fix implements URL sanitization that removes the userinfo component before logging URLs. Organizations should update their Go dependencies to use the patched version.

To update your Go application, modify your go.mod file to require the patched version and run go mod tidy to update dependencies. For additional security guidance, consult the HashiCorp Security Discussion forum.

Workarounds

• If immediate upgrade is not possible, implement a custom logger that sanitizes URLs before logging
• Configure go-retryablehttp to use a null logger or disable debug logging in production environments
• Avoid using HTTP basic authentication with credentials embedded in URLs when possible
• Restrict file system permissions on log directories to minimize exposure if credentials are logged
• Implement log rotation and secure deletion policies to limit the window of exposure

# Update go-retryablehttp to patched version
go get github.com/hashicorp/go-retryablehttp@v0.7.7
go mod tidy

# Verify the updated version
go list -m github.com/hashicorp/go-retryablehttp