CVE-2025-8959
📋 TL;DR
CVE-2025-8959 is a symlink attack vulnerability in HashiCorp's go-getter library that allows attackers to read files outside the intended download directory by exploiting the subdirectory download feature. This affects any software using go-getter to download files, potentially exposing sensitive data. Users of HashiCorp tools or third-party applications relying on go-getter are at risk.
💻 Affected Systems
- HashiCorp go-getter library
- Any software using go-getter for downloads
📦 What is this software?
Go Getter by Hashicorp
⚠️ Risk & Real-World Impact
Worst Case
Attackers could read arbitrary files on the system, such as configuration files, secrets, or sensitive data, leading to data breaches or privilege escalation.
Likely Case
Unauthorized access to files in directories adjacent to the download target, compromising application data or credentials.
If Mitigated
Limited impact if strict file permissions and isolation are enforced, but still poses a data leakage risk.
🎯 Exploit Status
Exploitation requires the ability to create symlinks and trigger downloads, which may involve social engineering or compromised sources.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.7.9
Vendor Advisory: https://discuss.hashicorp.com/t/hcsec-2025-23-hashicorp-go-getter-vulnerable-to-arbitrary-read-through-symlink-attack/76242
Restart Required: No
Instructions:
1. Update go-getter to version 1.7.9 or later. 2. For Go projects, run 'go get github.com/hashicorp/go-getter@v1.7.9'. 3. Rebuild and redeploy any affected applications.
🔧 Temporary Workarounds
Disable subdirectory downloads
allAvoid using the subdirectory download feature in go-getter to prevent symlink attacks.
Modify code to set DisableSymlinks: true in go-getter configurations if supported.
🧯 If You Can't Patch
- Restrict file permissions to limit read access to sensitive directories.
- Isolate download processes using containerization or sandboxing to contain potential breaches.
🔍 How to Verify
Check if Vulnerable:
Check the go-getter version in your project; if below 1.7.9, it is vulnerable. Use 'go list -m github.com/hashicorp/go-getter' in Go projects.Check Version:
go list -m github.com/hashicorp/go-getterVerify Fix Applied:
Confirm the go-getter version is 1.7.9 or higher after update. Run 'go version -m' on binaries or check dependency files.📡 Detection & Monitoring
Log Indicators:
- Unexpected file access errors or symlink-related warnings in application logs during download operations.
Network Indicators:
- Unusual download patterns from untrusted sources triggering go-getter calls.
SIEM Query:
Search for logs containing 'go-getter' and 'symlink' or 'permission denied' errors in download contexts.