Unicode Normalization Bypass in go-slug

Executive Summary

This vulnerability affects HashiCorp go-slug versions 0.4.0 through 0.18.2. A local attacker could bypass .terraformignore exclusions by exploiting improper Unicode normalization during path matching. This could cause sensitive files to be included in Terraform slug uploads without proper exclusion.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves improper Unicode normalization in path matching for Terraform slug uploads. To detect it, inspect Terraform configuration files and upload logs for any files that should be excluded by .terraformignore but are included. Check for paths with Unicode characters that may bypass exclusions.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could lead to unauthorized exposure of sensitive files during Terraform operations. Attackers might access confidential data, configuration files, or other restricted information that should have been excluded by .terraformignore rules.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized exposure of sensitive files during Terraform slug uploads, potentially violating data protection requirements under GDPR and HIPAA by allowing local attackers to bypass exclusions and access confidential information.

Useful 0 Not Useful 0

Mitigation Strategies

Update go-slug to a version beyond 0.18.2 to address the Unicode normalization issue in path matching.

Useful 0 Not Useful 0