CVE-2024-6257: HashiCorp Go-getter RCE Vulnerability

CVE-2024-6257 Overview

HashiCorp's go-getter library contains a command injection vulnerability that allows attackers to achieve arbitrary code execution through malicious manipulation of Git configurations. The library can be coerced into executing Git update operations on an existing maliciously modified Git configuration, enabling attackers to execute arbitrary code on affected systems.

Critical Impact

Attackers can leverage malicious Git configurations to execute arbitrary code on systems using vulnerable versions of the go-getter library, potentially leading to full system compromise.

Affected Products

• HashiCorp go-getter library
• Applications and tools that depend on go-getter for source retrieval
• HashiCorp products utilizing the go-getter library for module/configuration fetching

Discovery Timeline

• 2024-06-25 - CVE-2024-6257 published to NVD
• 2025-12-11 - Last updated in NVD database

Technical Details for CVE-2024-6257

Vulnerability Analysis

This vulnerability is classified as CWE-77 (Command Injection), which occurs when an application constructs all or part of a command using externally-influenced input without properly neutralizing special elements. In the context of go-getter, the library fails to adequately sanitize Git configuration settings before executing Git operations.

The go-getter library is a widely-used Go library designed to download files or directories from various sources using URL-like syntax. It supports multiple protocols including Git, HTTP, S3, and others. The vulnerability specifically affects the Git getter functionality, where an attacker with the ability to modify the local Git configuration can inject malicious commands that execute when the library performs Git update operations.

Root Cause

The root cause of this vulnerability lies in insufficient validation and sanitization of Git configuration parameters before they are used in Git command execution. When go-getter performs Git operations, it relies on the local Git configuration which can contain executable hooks and custom command configurations. If an attacker has previously modified this Git configuration, subsequent go-getter operations can trigger execution of attacker-controlled commands.

The library does not properly isolate or validate the Git environment before executing update operations, allowing malicious configuration values to influence command execution.

Attack Vector

The attack requires network-based interaction where a user must be coerced into performing a go-getter operation that triggers a Git update on a repository with a maliciously crafted Git configuration. The attack flow typically involves:

1. An attacker prepares a malicious Git repository with specially crafted configuration
2. The attacker convinces a victim to clone or update from this repository using an application that leverages go-getter
3. Malicious Git configuration hooks or command overrides execute arbitrary code in the context of the victim's user session

The vulnerability can be exploited through core Git configuration mechanisms such as core.sshCommand, core.gitProxy, or Git hooks that are specified in the repository's configuration. When go-getter performs update operations, these malicious configurations execute with the privileges of the user running the application.

Detection Methods for CVE-2024-6257

Indicators of Compromise

• Unexpected Git configuration modifications in .git/config or global Git configuration files
• Suspicious command executions spawned from Git processes or applications using go-getter
• Unusual network connections initiated during source retrieval operations
• Modified or newly created Git hooks in repository directories

Detection Strategies

• Monitor process execution trees for suspicious child processes spawned from Git operations
• Implement file integrity monitoring on Git configuration files to detect unauthorized modifications
• Audit applications in your environment that utilize the go-getter library for source retrieval
• Review dependency manifests (go.mod, go.sum) to identify usage of vulnerable go-getter versions

Monitoring Recommendations

• Enable detailed logging for applications that perform automated source retrieval operations
• Configure endpoint detection and response (EDR) solutions to alert on suspicious Git-related command chains
• Monitor for creation or modification of Git hook scripts in unexpected locations
• Implement network monitoring to detect unusual outbound connections during build or deployment processes

How to Mitigate CVE-2024-6257

Immediate Actions Required

• Identify all applications and services in your environment that depend on HashiCorp's go-getter library
• Review the HashiCorp Security Advisory HCSEC-2024-13 for specific version guidance
• Update go-getter to the latest patched version as recommended by HashiCorp
• Audit existing Git repositories for suspicious configuration entries

Patch Information

HashiCorp has released security patches addressing this vulnerability. Organizations should consult the official HashiCorp Security Advisory HCSEC-2024-13 for the specific patched version and update their go-getter dependency accordingly. The patch implements proper sanitization of Git configurations before executing Git operations.

Workarounds

• Restrict the sources from which applications using go-getter can retrieve content to trusted repositories only
• Implement network-level controls to limit outbound connectivity from build and deployment systems
• Run applications that use go-getter with minimal privileges and in isolated environments
• Consider using alternative source retrieval mechanisms for untrusted content sources until patching is complete