Path Traversal in Trivy via Terraform Filesystem Functions

Executive Summary

Trivy before version 0.71.0 has a path traversal vulnerability in its Terraform filesystem functions. When scanning untrusted Terraform configurations, functions like file() or filebase64() could access files outside the intended scan directory using directory traversal sequences (e.g., ../). This happens because the filesystem allowed access above the scan root. The vulnerability could expose sensitive data if such files exist and are included in scan output.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, scan Terraform configurations using Trivy version 0.71.0 or later. Use the command: trivy fs --security-checks misconf /path/to/terraform/config. Check for path traversal attempts in logs or output that reference parent directories (e.g., ../).

Verify Trivy version with: trivy --version. If using an older version, update Trivy to 0.71.0 or higher to ensure the fix is applied.

Useful 0 Not Useful 0

Impact Analysis

If you use Trivy to scan Terraform configurations from untrusted sources (e.g., third-party pull requests), an attacker could craft a Terraform file that uses path traversal to access sensitive files outside the scan directory. If those files are referenced in the configuration, their contents could be exposed in Trivy's scan output. This risk is higher when scanning subdirectories where shared files reside at the repository root.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating compliance requirements under GDPR (e.g., unauthorized data access) or HIPAA (e.g., exposure of protected health information). If scan outputs include sensitive data accessed via path traversal, organizations may fail to meet data protection obligations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Trivy to version 0.71.0 or later to apply the sandboxing fix for Terraform filesystem functions. This prevents path traversal by restricting file access to the scan root directory.

Scan Terraform configurations from the repository root to avoid false positives and ensure all files are within the intended scan boundary. Suppress checks only if necessary and after validation.

Useful 0 Not Useful 0