Terrascan vulnerabilities

Terrascan v1.18.3 and prior are vulnerable to SSRF via external URL resolution in uploaded IaC templates when running in server mode. An unauthenticated attacker can upload a template with a field pointing to a controlled URL, causing server-side fetch. Local file read via file:// scheme is also possible.

Terrascan v1.18.3 and prior are vulnerable to SSRF via the remote_url parameter in the remote directory scan endpoint in server mode. An unauthenticated attacker can supply an HTTP URL passed to go-getter without validation. Go-getter supports X-Terraform-Get header for redirect to file:// URL, enabling local file read. Additionally, ~/.netrc is read, potentially leaking credentials.

Terrascan v1.18.3 and prior are vulnerable to SSRF via the webhook_url parameter in the file scan endpoint (POST /v1/{iac}/{iacVersion}/{cloud}/local/file/scan) in server mode. An unauthenticated attacker can supply an arbitrary URL, and Terrascan sends scan results with the webhook token to that URL.