CVE-2023-4782: Hashicorp Terraform Path Traversal Flaw

CVE-2023-4782 Overview

CVE-2023-4782 is a Path Traversal vulnerability affecting HashiCorp Terraform versions 1.0.8 through 1.5.6. The vulnerability allows arbitrary file write during the init operation when run on maliciously crafted Terraform configuration files. This flaw stems from improper input validation (CWE-22) that enables attackers to write files to arbitrary locations on the filesystem, potentially leading to code execution, privilege escalation, or system compromise.

Critical Impact

Attackers can leverage malicious Terraform configurations to write arbitrary files to the target system during initialization, potentially overwriting critical system files or planting malicious executables.

Affected Products

• HashiCorp Terraform versions 1.0.8 through 1.5.6
• Any system running affected Terraform versions with untrusted configuration sources
• CI/CD pipelines and automation systems executing terraform init on external configurations

Discovery Timeline

• 2023-09-08 - CVE-2023-4782 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-4782

Vulnerability Analysis

This vulnerability exists in Terraform's initialization process, specifically during the terraform init command execution. The flaw allows an attacker to craft malicious Terraform configuration files that, when processed by the init operation, can write files to arbitrary locations outside the intended working directory.

The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as Path Traversal. This class of vulnerabilities occurs when software uses external input to construct a pathname without properly neutralizing special elements that could cause the pathname to resolve to an unintended location.

The attack requires local access and user interaction in the form of running terraform init on a malicious configuration. However, in automated CI/CD environments where Terraform configurations may be pulled from external sources, this vulnerability poses a significant risk as the initialization process is often automated without manual review.

Root Cause

The root cause lies in insufficient path validation during Terraform's initialization phase. When processing configuration files, Terraform fails to properly sanitize file paths, allowing directory traversal sequences (such as ../) or absolute paths to be interpreted literally. This enables malicious configurations to specify write targets outside the Terraform working directory.

Attack Vector

The attack vector for CVE-2023-4782 requires local access to execute. An attacker must craft a malicious Terraform configuration and convince a victim to run terraform init on it, or inject the malicious configuration into a repository that feeds into an automated Terraform pipeline.

The exploitation scenario typically involves:

1. Attacker creates or modifies Terraform configuration with malicious file write directives
2. Victim obtains and runs terraform init on the configuration (directly or via automation)
3. Terraform writes files to arbitrary filesystem locations during initialization
4. Attacker achieves code execution, persistence, or data manipulation depending on targeted files

Since no verified code examples are available, the vulnerability mechanism involves maliciously crafted Terraform module configurations that exploit path traversal weaknesses during the provider or module download and extraction phases of the init command. For detailed technical analysis, refer to the HashiCorp Security Advisory.

Detection Methods for CVE-2023-4782

Indicators of Compromise

• Unexpected files appearing in system directories after running terraform init
• Terraform configuration files containing unusual path references with ../ sequences
• Modified system binaries, cron jobs, or startup scripts coinciding with Terraform operations
• Unexpected file modifications in directories outside the Terraform working directory

Detection Strategies

• Audit Terraform configurations before execution, especially from untrusted sources
• Monitor filesystem write operations during terraform init execution for writes outside the working directory
• Implement file integrity monitoring (FIM) on critical system directories
• Review CI/CD pipeline logs for anomalous Terraform behavior or unexpected file operations

Monitoring Recommendations

• Deploy endpoint detection and response (EDR) solutions to monitor Terraform process behavior
• Configure alerts for file writes by Terraform processes to sensitive system paths
• Implement sandboxing or containerization for Terraform operations to limit filesystem access
• Enable verbose logging for Terraform operations in automated pipelines

How to Mitigate CVE-2023-4782

Immediate Actions Required

• Upgrade HashiCorp Terraform to version 1.5.7 or later immediately
• Audit all existing Terraform configurations for potentially malicious content
• Review CI/CD pipelines to ensure Terraform configurations come from trusted sources only
• Consider running Terraform operations in isolated environments with restricted filesystem access

Patch Information

HashiCorp has addressed this vulnerability in Terraform version 1.5.7. Organizations should upgrade all Terraform installations to this version or later. The fix implements proper path validation during the initialization process to prevent directory traversal attacks.

For detailed patch information and upgrade instructions, see the HashiCorp Security Advisory (HCSEC-2023-27).

Workarounds

• Run Terraform in containerized or sandboxed environments with minimal filesystem permissions
• Implement strict code review processes for all Terraform configuration changes
• Use policy-as-code tools to validate Terraform configurations before execution
• Restrict network access during Terraform initialization to prevent fetching malicious remote modules

# Example: Run Terraform in a container with restricted filesystem access
docker run --rm -v $(pwd):/workspace:ro \
  -v /path/to/safe/output:/workspace/.terraform \
  --read-only \
  hashicorp/terraform:1.5.7 init

# Verify Terraform version is patched
terraform version
# Should show: Terraform v1.5.7 or higher