CVE-2020-29529
📋 TL;DR
This vulnerability in HashiCorp go-slug allows attackers to bypass directory traversal protections when unpacking tar archives using specially crafted symlinks. This could enable writing files outside the intended extraction directory, potentially leading to arbitrary file write or code execution. Anyone using go-slug versions up to 0.4.3 for tar archive processing is affected.
💻 Affected Systems
- HashiCorp go-slug
📦 What is this software?
Go Slug by Hashicorp
⚠️ Risk & Real-World Impact
Worst Case
Arbitrary file write leading to remote code execution, system compromise, or data exfiltration
Likely Case
Arbitrary file write allowing file tampering, privilege escalation, or denial of service
If Mitigated
Limited to file writes within restricted directories if proper sandboxing exists
🎯 Exploit Status
Exploitation requires ability to provide malicious tar archives; GitHub Security Lab published detailed advisory with exploitation details
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.5.0
Vendor Advisory: https://github.com/hashicorp/go-slug/releases/tag/v0.5.0
Restart Required: No
Instructions:
1. Update go-slug dependency to version 0.5.0 or later in your Go project. 2. Run 'go get github.com/hashicorp/go-slug@v0.5.0'. 3. Rebuild and redeploy your application.
🔧 Temporary Workarounds
Validate tar archives before processing
allImplement pre-processing validation to reject archives containing symlinks or suspicious paths
Use sandboxed extraction directory
allExtract archives to isolated, temporary directories with restricted permissions
🧯 If You Can't Patch
- Disable tar archive processing functionality entirely
- Implement strict input validation and sanitization for all archive uploads
🔍 How to Verify
Check if Vulnerable:
Check your go.mod file for 'github.com/hashicorp/go-slug' version; if version is <=0.4.3, you are vulnerableCheck Version:
grep 'hashicorp/go-slug' go.modVerify Fix Applied:
Verify go.mod contains 'github.com/hashicorp/go-slug v0.5.0' or later📡 Detection & Monitoring
Log Indicators:
- Unexpected file writes outside extraction directories
- Multiple symlink creation attempts in tar archives
- Permission errors for files outside expected paths
Network Indicators:
- Large or unusual tar archive uploads to vulnerable endpoints
SIEM Query:
source="application_logs" AND ("symlink" OR "directory traversal" OR "../") AND process="your_application_name"🔗 References
- https://github.com/hashicorp/go-slug/compare/v0.4.3...v0.5.0
- https://github.com/hashicorp/go-slug/pull/12
- https://github.com/hashicorp/go-slug/releases/tag/v0.5.0
- https://securitylab.github.com/advisories/GHSL-2020-262-zipslip-go-slug
- https://github.com/hashicorp/go-slug/compare/v0.4.3...v0.5.0
- https://github.com/hashicorp/go-slug/pull/12
- https://github.com/hashicorp/go-slug/releases/tag/v0.5.0
- https://securitylab.github.com/advisories/GHSL-2020-262-zipslip-go-slug
