CVE-2025-8959: Hashicorp Go-getter Symlink Vulnerability

CVE-2025-8959 Overview

HashiCorp's go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designated directory boundaries. This vulnerability affects the widely-used go-getter library, which is commonly integrated into infrastructure-as-code tools and configuration management systems for downloading files and modules from various sources. By exploiting this symlink vulnerability, attackers can escape directory boundaries and read arbitrary files on the system.

Critical Impact

Attackers can leverage malicious symlinks within downloaded content to escape intended directory restrictions and gain unauthorized read access to sensitive files on the host system, potentially exposing configuration files, secrets, and other confidential data.

Affected Products

• HashiCorp go-getter versions prior to 1.7.9
• Applications and tools that integrate the vulnerable go-getter library
• Infrastructure automation tools using go-getter for module/file downloads

Discovery Timeline

• 2025-08-15 - CVE-2025-8959 published to NVD
• 2025-12-11 - Last updated in NVD database

Technical Details for CVE-2025-8959

Vulnerability Analysis

This vulnerability is classified as a Symlink Attack (CWE-59) affecting HashiCorp's go-getter library. The flaw resides in the subdirectory download feature, which fails to properly validate and sanitize symbolic links within downloaded content. When a user downloads content from an attacker-controlled source, the attacker can craft malicious symlinks that point to files or directories outside the intended download location.

The go-getter library is designed to facilitate downloading files and directories from various sources including Git repositories, HTTP endpoints, Amazon S3, and other storage systems. The subdirectory feature allows users to specify a particular directory within the downloaded content to extract. However, insufficient validation of symlinks within this subdirectory allows path traversal through symbolic link resolution.

Root Cause

The root cause of this vulnerability lies in the improper handling of symbolic links during the subdirectory extraction process. The go-getter library fails to verify that symlink targets remain within the expected directory boundaries. When processing downloaded content that contains symlinks, the library follows these links without checking whether the resolved path escapes the designated extraction directory. This allows an attacker to create symlinks pointing to sensitive files such as /etc/passwd, /etc/shadow, application configuration files, or private keys.

Attack Vector

The attack is network-based and requires no authentication or user interaction beyond initiating a download from an attacker-controlled source. An attacker can set up a malicious repository or file server containing crafted symlinks. When a victim uses go-getter to download and process content from this source, the symlinks are followed, granting the attacker read access to arbitrary files on the victim's system.

The attack scenario typically involves:

1. An attacker creates a malicious source (e.g., Git repository) containing symlinks pointing to sensitive system files
2. A victim application using go-getter downloads content from this source with subdirectory extraction enabled
3. The go-getter library processes the symlinks without proper validation
4. The attacker can retrieve sensitive file contents through the resolved symlink paths

For detailed technical information, refer to the HashiCorp Security Advisory HCSEC-2025-23.

Detection Methods for CVE-2025-8959

Indicators of Compromise

• Unexpected symlinks in downloaded directories pointing to paths outside the extraction directory
• Access log entries showing reads of sensitive files (e.g., /etc/passwd, configuration files) from go-getter processes
• File system monitoring alerts indicating symbolic link creation in temporary download directories
• Anomalous read access to sensitive system files from applications using go-getter

Detection Strategies

• Monitor file system operations for symlink creation in go-getter working directories that point to paths outside expected boundaries
• Implement application-level logging to track go-getter download sources and validate against known-good lists
• Use security tools to detect path traversal attempts through symbolic link resolution
• Audit dependency manifests to identify applications using vulnerable go-getter versions (prior to 1.7.9)

Monitoring Recommendations

• Enable detailed logging for all go-getter operations including source URLs and extracted file paths
• Configure file integrity monitoring (FIM) on sensitive system files to detect unauthorized access
• Implement network monitoring to detect connections to suspicious or untrusted download sources
• Set up alerts for any go-getter process attempting to read files outside designated download directories

How to Mitigate CVE-2025-8959

Immediate Actions Required

• Upgrade go-getter to version 1.7.9 or later immediately
• Audit all applications and dependencies that use go-getter to ensure they are using the patched version
• Review recent downloads from external sources for suspicious symlinks
• Implement network-level controls to restrict go-getter downloads to trusted sources only

Patch Information

HashiCorp has released go-getter version 1.7.9 which addresses this vulnerability. The fix includes proper validation of symbolic links during subdirectory extraction to ensure they do not resolve to paths outside the intended directory boundaries. Organizations should update to this version or later as soon as possible.

For complete patch details and upgrade instructions, see the HashiCorp Security Advisory HCSEC-2025-23.

Workarounds

• Restrict go-getter downloads to trusted and verified sources only until patching is complete
• Implement additional validation layers in applications to check for symlinks before processing downloaded content
• Run go-getter operations in sandboxed environments with restricted file system access
• Use chroot or container isolation to limit the scope of potential symlink traversal attacks

# Verify go-getter version in your Go modules
go list -m github.com/hashicorp/go-getter

# Update to patched version
go get github.com/hashicorp/go-getter@v1.7.9

# Verify the update
go list -m github.com/hashicorp/go-getter