CVE-2024-6257

What it actually does

The library can be tricked into running a Git update against a pre-planted malicious .gitconfig, causing arbitrary shell commands to execute under the privileges of the calling process.

Why it matters to the business

Applications and build pipelines that fetch modules or dependencies via go-getter become vectors for full host compromise, source-code theft, or supply-chain insertion, increasing breach and operational-disruption risk until patched.

How an attack unfolds

An attacker first plants a malicious .gitconfig containing a malicious core.sshCommand or similar hook, then supplies a repository URL to the vulnerable go-getter client; when the client performs its update step the injected configuration causes the embedded Git binary to execute attacker-controlled commands.

How to fix it

Upgrade hashicorp/go-getter to commit 5a63fd9c0d5b8da8a6805e8c283f46f0dacb30b3 or a later release that contains the fix; rebuild and redeploy all consuming applications and containers.

How to confirm the fix worked

Confirm the go-getter module version or commit hash in go.mod / vendor tree matches the fixed revision; run regression tests that exercise Git-backed getters with malicious configuration files to verify command execution is no longer possible.

Typical attack path

1. Plant a malicious .gitconfig reachable by the target process
2. Craft a go-getter URL or path that references an existing Git working tree
3. Trigger the client code path that calls Git update or fetch
4. Git honors the attacker-controlled configuration and executes the payload
5. Attacker obtains code execution on the host

How to detect it

Review application and build logs for unexpected Git subprocess invocations or .gitconfig writes immediately before dependency fetches; correlate with process-creation events showing shell commands originating from the go-getter code path.

What your security team should do

• Immediately update all direct and transitive uses of go-getter to the patched commit
• Scan build pipelines and dependency manifests for the vulnerable library
• Add dependency-update and integrity checks to CI to prevent re-introduction of older versions