Skip to main content

Supply Chain Attack - Terraform

Description

Terraform dependencies are not pinned, allowing a malicious actor to override the used components with malicious components without leaving a trace.

Impact

Override depdendencies or component with malicious content.

Recommendation

Use mechanisms such as git-commits, or artifacts and hashes to verify the data integrity.

Threat

Anonymous attacker from Internet with write access to the provider releases.

Score

Default score using CVSS 3.1. It may change depending on the context of the vulnerability.

Base

  • Attack vector: N
  • Attack complexity: H
  • Privileges required: N
  • User interaction: R
  • Scope: U
  • Confidentiality: N
  • Integrity: L
  • Availability: N

Temporal

  • Exploit code madurity: U
  • Remediation level: O
  • Report confidence: R

Result

  • Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:R
  • Score:
    • Base: 3.1
    • Temporal: 2.6
  • Severity:
    • Base: Low
    • Temporal: Low

Details

Why

Terraform providers are installed as:

  required_providers {
aws = {
source = "hashicorp/aws"
version = "~> 3.23.0"
}
cloudflare = {
source = "cloudflare/cloudflare"
version = "~> 2.20.0"
}
}

not only they are not pinned, but also a version like 2.20.0 has no guarantees because a malicious actor with access to the provider release process can override tags with malicious content, changing the legit 2.20.0 for malicious 2.20.0 without us noticing

Requirements