Executive brief
Terrascan, a tool used to scan Infrastructure as Code for security violations, contains a vulnerability in its server mode that allows unauthorized remote attackers to access sensitive local files. By sending a specially crafted request to the scanning service, an attacker can trick the system into reading internal configuration files or stealing stored credentials. This could lead to a full compromise of the server or the cloud environments it manages. Because the project is archived, no official security updates will be released.
Technical details
Terrascan's remote directory scan endpoint (POST /v1/{iac}/{iacVersion}/{cloud}/remote/dir/scan) is vulnerable to Server-Side Request Forgery (SSRF) when running in server mode. An unauthenticated remote attacker can provide a malicious URL via the 'remote_url' parameter, which is passed without validation to the 'hashicorp/go-getter' library. By leveraging the 'X-Terraform-Get' response header, an attacker can force the server to redirect the request to a 'file://' URL, enabling local file disclosure. Furthermore, because 'go-getter' has 'Netrc' enabled by default, it may read and transmit credentials from the '~/.netrc' file to an attacker-controlled host. The project was archived in 2023 and no patch is available; users should avoid running Terrascan in server mode on untrusted networks.
Affected products
- Tenable Terrascan v1.18.3 and prior
Timeline
- 2023-08-01: other: Project archived by maintainer
- 2026-05-19: disclosed: CVE published