PT-2020-17183 · Hashicorp · Go-Slug

Chris Smowton + 1 · Published 2020-12-03 · Updated 2023-02-06 · CVE-2020-29529

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp go-slug versions 0.4.3 and earlier

Description The issue allows a malicious attacker to bypass protections against directory traversal during archive extraction by chaining multiple symbolic links within the archive. This enables the creation of files outside the target directory. If the attacker can read extracted files, they may create symbolic links to arbitrary files on the system that the unpacker has permissions to read. The vulnerability involves attempts at directory traversal using ../ and symlinks.

Recommendations For HashiCorp go-slug versions 0.4.3 and earlier, update to version 0.5.0 to resolve the issue. As a temporary workaround, consider restricting the use of symbolic links within archives to minimize the risk of exploitation. Avoid using the go-slug tool to unpack archives from untrusted sources until the issue is resolved.

Exploit

Fix

Link Following

Path traversal

Weakness Enumeration

CWE-59

CWE-22

Related Identifiers

CVE-2020-29529

GHSA-2G5J-5X95-R6HR

GO-2021-0094

Affected Products

Go-Slug

References · 19

• 🔥 https://securitylab.github.com/advisories/GHSL-2020-262-zipslip-go-slug · Exploit
• https://github.com/hashicorp/go-slug/pull/12 · Patch
• https://github.com/hashicorp/go-slug/compare/v0.4.3...v0.5.0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-29529 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-29529 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2g5j-5x95-r6hr · Vendor Advisory
• https://osv.dev/vulnerability/GO-2021-0094 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-29529 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-29529 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-29529 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-29529 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-29529 · Vendor Advisory
• https://github.com/hashicorp/go-slug/commit/764785bc4cbb9e600ad1cf1a6bd21b535c182983 · Note
• https://github.com/hashicorp/go-slug/commit/28cafc59c8da6126a3ae94dfa84181df4073454f · Note
• https://github.com/hashicorp/go-slug · Note