Executive brief
Terrascan, a tool used to scan Infrastructure as Code (IaC) for security risks, contains a vulnerability when running in its server mode. An unauthenticated attacker can upload a malicious configuration file that forces the server to access internal resources or read local files. This could lead to the exposure of sensitive system information or internal network data. Because the project was archived in 2023, no official security patch will be released.
Technical details
Terrascan is vulnerable to Server-Side Request Forgery (SSRF) when running in server mode (terrascan server). The vulnerability exists in the parsing of ARM and CloudFormation templates, where external URLs in fields like templateLink.uri or TemplateURL are resolved using the hashicorp/go-getter library. Because default detectors including FileDetector are enabled, an unauthenticated remote attacker can use the file:// protocol to perform local file reads or target internal network services. The server binds to 0.0.0.0 by default with no authentication. As the project was archived in August 2023, no patch is available, and users are advised to avoid running the software in server mode or migrate to supported alternatives.
Affected products
- Tenable Terrascan v1.18.3 and prior
Timeline
- 2023-08-01: other: Project archived by maintainer
- 2026-05-19: disclosed: Vulnerability published