Executive brief
Terrascan, a tool used to detect security violations in cloud infrastructure code, contains a vulnerability when running in server mode. An unauthenticated attacker can trick the server into sending sensitive scan results to an external web address they control. Because the product has been archived and will not receive updates, this issue remains unpatched and could lead to the exposure of internal security configurations.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Terrascan's 'terrascan server' mode within the file scan endpoint (POST /v1/{iac}/{iacVersion}/{cloud}/local/file/scan). The application fails to validate the 'webhook_url' multipart form parameter, allowing an unauthenticated remote attacker to specify an arbitrary destination. Upon completion of a scan, the server sends an HTTP POST request containing the full JSON scan results and an attacker-provided bearer token to the specified URL. The server's HTTP client is configured to retry this request up to 10 times on failure. As the project was archived in August 2023, no patch is available.
Affected products
- Tenable Terrascan v1.18.3 and prior
Timeline
- 2023-08: other: Project archived by vendor
- 2026-05-19: disclosed: CVE published