CVE-2022-30321: HashiCorp go-getter unsafe downloads
8.6
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.77068%
CWE
-
Published
5/26/2022
Updated
2/9/2023
KEV Status
No
Technology
Go
GoTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/hashicorp/go-getter | go | < 1.6.1 | 1.6.1 |
| github.com/hashicorp/go-getter | go | >= 2.0.0, < 2.1.0 | 2.1.0 |
| github.com/hashicorp/go-getter/v2 | go | < 2.1.0 | 2.1.0 |
| github.com/hashicorp/go-getter/s3/v2 | go | < 2.1.0 | 2.1.0 |
| github.com/hashicorp/go-getter/gcs/v2 | go | < 2.1.0 | 2.1.0 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from three main issues: 1) HTTP header processing flaws in HttpGetter.Get that allowed protocol switching and redirect loops, 2) Insufficient path sanitization in subdirectory (client.go) and filename handling, and 3) Command injection vectors in hg/git command execution. The commit adds validation checks (containsDotDot), argument sanitization (-- in hg commands), timeout controls, and redirect limits to address these. The affected functions are clearly identified in the diff through added security checks and modified command execution patterns.