CVE-2022-30321
📋 TL;DR
This vulnerability in the go-getter library allows attackers to perform path traversal, symlink processing, and command injection attacks, potentially leading to arbitrary file access and remote code execution. It affects applications using go-getter versions up to 1.5.11 and 2.0.2 for downloading files from remote sources. Users of HashiCorp tools like Terraform, Packer, and Vault that depend on go-getter are particularly vulnerable.
💻 Affected Systems
- go-getter library
- Terraform
- Packer
- Vault
- Consul
- Nomad
- Boundary
- Waypoint
📦 What is this software?
Go Getter by Hashicorp
Go Getter by Hashicorp
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via remote code execution, allowing attackers to execute arbitrary commands, access sensitive data, and pivot to other systems.
Likely Case
Arbitrary file read/write access leading to data exfiltration, configuration manipulation, or privilege escalation.
If Mitigated
Limited impact if proper input validation and sandboxing are implemented, potentially only affecting isolated containers or temporary files.
🎯 Exploit Status
Exploitation requires the application to process attacker-controlled URLs or file sources. The vulnerability details and proof-of-concept are publicly available in the HashiCorp advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: go-getter 1.6.1, 2.1.0
Vendor Advisory: https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vulnerabilities-in-go-getter-library/39930
Restart Required: Yes
Instructions:
1. Update go-getter dependency to 1.6.1+ or 2.1.0+ in your Go modules. 2. Rebuild and redeploy affected applications. 3. For HashiCorp products, update to versions that include the patched go-getter library.
🔧 Temporary Workarounds
Input Validation and Sanitization
allValidate and sanitize all URLs and file sources before passing to go-getter functions.
Disable Untrusted Sources
allConfigure applications to only use trusted, whitelisted sources for go-getter operations.
🧯 If You Can't Patch
- Implement strict network controls to limit go-getter's ability to fetch from untrusted or external sources.
- Run vulnerable applications in isolated containers with minimal privileges and filesystem access.
🔍 How to Verify
Check if Vulnerable:
Check your go.mod file for go-getter dependency version: grep 'github.com/hashicorp/go-getter' go.modCheck Version:
go list -m github.com/hashicorp/go-getterVerify Fix Applied:
Verify go-getter version is 1.6.1+ or 2.1.0+ in go.mod and that the application rebuilds successfully.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns
- Unexpected symlink creation
- Suspicious command execution from go-getter processes
Network Indicators:
- Unexpected outbound connections from go-getter to unusual hosts or IPs
SIEM Query:
process_name:"terraform" OR process_name:"packer" AND (cmdline:".." OR cmdline:"/etc/passwd" OR cmdline:"/bin/sh")🔗 References
- https://discuss.hashicorp.com
- https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vulnerabilities-in-go-getter-library/39930
- https://github.com/hashicorp/go-getter/releases
- https://discuss.hashicorp.com
- https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vulnerabilities-in-go-getter-library/39930
- https://github.com/hashicorp/go-getter/releases
