CVE-2026-47357

Vulnerability

Terrascan v1.18.3 and prior, an archived static code analyzer for Infrastructure as Code, contain a Server-Side Request Forgery (SSRF) vulnerability in the remote directory scan endpoint (POST /v1/{iac}/{iacVersion}/{cloud}/remote/dir/scan) when running in server mode. The endpoint accepts an attacker-controlled remote_url parameter with remote_type set to "http". This URL is passed directly to hashicorp/go-getter (v1.7.5) without any validation. The HttpGetter in go-getter supports the X-Terraform-Get response header, which allows an attacker's server to redirect the initial HTTP request to a file:// URL, enabling local file read. Furthermore, HttpGetter is configured with Netrc set to true, causing it to read ~/.netrc and transmit stored credentials to attacker-controlled hostnames [1].

Exploitation

An unauthenticated remote attacker can send a crafted HTTP POST request to the remote/dir/scan endpoint. The attacker sets remote_type to "http" and supplies a malicious URL in remote_url. The attacker's webserver responds with an HTTP X-Terraform-Get header pointing to a file:// URL (e.g., file:///etc/passwd). Terrascan's go-getter follows the redirect and reads the local file. Additionally, because Netrc is enabled, if the attacker's server requests HTTP Basic authentication, Terrascan will send credentials stored in the user's ~/.netrc file. The server mode binds to 0.0.0.0 with no authentication, making this endpoint fully accessible to any network actor [1].

Impact

A successful attack results in unauthorized disclosure of arbitrary files from the Terrascan server's filesystem (including sensitive configuration files) and exfiltration of credentials stored in ~/.netrc. This can lead to further credential-based attacks against infrastructure targets. The server runs unauthenticated, so no prior access is required. The impact is considered High due to the confidentiality breach and potential lateral movement [1].

Mitigation

No fix will be released. The Terrascan project was archived in August 2023 and is no longer maintained [1]. Users must avoid deploying Terrascan in server mode in untrusted networks. If server mode is required, it should be placed behind a firewall or reverse proxy with strict access controls. For IaC scanning, users should migrate to actively maintained alternatives. This vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of May 2026 [1].