CVE-2024-3817: HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches
9.8
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.37381%
CWE
Published
4/17/2024
Updated
4/28/2024
KEV Status
No
Technology
Go
GoTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/hashicorp/go-getter | go | >= 1.5.9, < 1.7.4 | 1.7.4 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability description states that an attacker can format a Git URL to inject additional Git arguments. The provided commit 268c11cae8cf0d9374783e06572679796abe9ce9 patches this by adding "--" before the URL argument in git commands. This "--" argument tells git to treat all subsequent arguments as positional arguments (like filenames or URLs) and not as options, even if they start with a dash. The functions clone and findRemoteDefaultBranch in get_git.go were modified in this way. Therefore, these functions were previously vulnerable to argument injection because they passed user-controlled URLs directly to git commands without this safeguard.