CVE-2025-0377
📋 TL;DR
HashiCorp's go-slug library is vulnerable to a zip-slip attack when extracting tar archives with non-existing user-provided paths. This allows attackers to write arbitrary files outside the intended extraction directory, potentially leading to remote code execution. Any application using go-slug to process untrusted tar archives is affected.
💻 Affected Systems
- HashiCorp go-slug
📦 What is this software?
Go Slug by Hashicorp
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the application processing the tar archive, allowing complete system compromise.
Likely Case
Arbitrary file write to sensitive locations, potentially leading to privilege escalation, data corruption, or denial of service.
If Mitigated
Limited impact if proper sandboxing, file permission restrictions, and input validation are in place.
🎯 Exploit Status
Requires the ability to upload or provide a malicious tar archive to an application using go-slug. No public exploit code is available yet.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v0.14.0
Vendor Advisory: https://discuss.hashicorp.com/t/hcsec-2025-01-hashicorp-go-slug-vulnerable-to-zip-slip-attack
Restart Required: No
Instructions:
1. Update go-slug dependency to v0.14.0 or later. 2. Run 'go get github.com/hashicorp/go-slug@v0.14.0'. 3. Rebuild and redeploy affected applications.
🔧 Temporary Workarounds
Input validation and sanitization
allValidate and sanitize tar archive entries before extraction, rejecting paths with directory traversal sequences.
Sandbox extraction
allExtract archives in a sandboxed environment with restricted filesystem access.
🧯 If You Can't Patch
- Disable tar archive processing from untrusted sources
- Implement strict file permission controls and monitor for suspicious file writes
🔍 How to Verify
Check if Vulnerable:
Check go.mod or go.sum for go-slug version. If version is <0.14.0, the system is vulnerable.Check Version:
grep 'hashicorp/go-slug' go.mod || grep 'hashicorp/go-slug' go.sumVerify Fix Applied:
Verify go-slug version is >=0.14.0 in go.mod/go.sum and rebuild the application.📡 Detection & Monitoring
Log Indicators:
- Unexpected file writes outside extraction directory
- Failed tar extraction attempts with suspicious paths
Network Indicators:
- Large or unusual tar archive uploads to affected services
SIEM Query:
source="application_logs" AND ("tar extraction failed" OR "path traversal" OR "go-slug")