CVE-2024-3817

What it actually does

Argument injection into Git commands executed by go-getter when discovering remote branches, enabling arbitrary command execution on the host.

Why it matters to the business

Full system compromise is possible through unauthenticated remote attackers, risking data theft, ransomware deployment, or service disruption in any application or supply chain depending on this library.

How an attack unfolds

An attacker supplies crafted input containing Git argument separators or options that are passed unsafely to the Git binary during remote branch enumeration; the injected arguments cause Git to execute attacker-controlled commands instead of the intended branch lookup.

How to fix it

Upgrade hashicorp/go-getter (GIT) to commit 268c11cae8cf0d9374783e06572679796abe9ce9 or later; the go-getter/v2 package is unaffected.

How to confirm the fix worked

Confirm the go-getter import path resolves to the fixed commit via go list -m or equivalent dependency tooling; re-run any unit tests that exercise Git remote discovery.

Typical attack path

1. Locate an application or build process that imports vulnerable go-getter and triggers Git-based remote discovery
2. Craft malicious input containing argument injection payloads targeting the branch discovery code path
3. Submit the input via network request, configuration, or dependency URL
4. Trigger the vulnerable code path so the injected arguments reach the Git executable
5. Achieve arbitrary command execution with the privileges of the go-getter process

How to detect it

Review application and build logs for Git invocations containing unexpected flags, semicolons, or redirection characters; inspect process creation events around go-getter usage for anomalous child processes.

What your security team should do

• Immediately update all direct and transitive dependencies on hashicorp/go-getter to the fixed commit
• Audit build pipelines and applications that perform Git operations via go-getter for exposure
• Add dependency pinning and automated scanning to prevent future vulnerable versions
• Monitor process execution logs for unexpected Git arguments or child processes spawned during branch discovery