Path Traversal in HashiCorp go-getter

Executive Summary

HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during directory downloads from S3 and GCS. This allows files to be written outside the intended destination directory if an attacker manipulates object names in a bucket accessed in directory mode.

Useful 0 Not Useful 0

Detection Guidance

Check installed go-getter versions with commands like 'go list -m github.com/hashicorp/go-getter' or 'go list -m github.com/hashicorp/go-getter/v2'. If versions are below 1.8.10 or 2.2.5 respectively, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to write malicious files outside the intended directory, potentially leading to code execution, data corruption, or unauthorized access to sensitive files on your system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized file writes outside intended directories during S3 or GCS directory downloads. If exploited, it may lead to unauthorized access or modification of sensitive data, violating data protection requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade go-getter to version 1.8.10 or higher and go-getter/v2 to version 2.2.5 or higher. Review S3/GCS directory download configurations to ensure object names cannot be manipulated.

Useful 0 Not Useful 0