CVE-2024-56802: Tapir Auth Bypass Vulnerability

CVE-2024-56802 Overview

CVE-2024-56802 affects Tapir, a private Terraform registry maintained by PacoVK. Tapir versions 0.9.0 and 0.9.1 contain an authorization flaw in the scope-able Deploykey lookup logic. Attackers can guess or supply a partial key value and receive a valid Deploykey, granting write access to the registry. The weakness is classified under CWE-285: Improper Authorization. Users must upgrade to version 0.9.2 to remediate the issue.

Critical Impact
An unauthenticated network attacker can obtain Deploykeys through non-exact matching, enabling unauthorized write access to private Terraform modules served by Tapir.

Affected Products

Tapir 0.9.0
Tapir 0.9.1
Tapir registries deployed on AWS DynamoDB and Azure CosmosDB backends

Discovery Timeline

2024-12-31 - CVE-2024-56802 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-56802

Vulnerability Analysis

Tapir authenticates write operations to its Terraform registry using Deploykeys. The getDeployKeyByValue method in both the DynamoDB and CosmosDB repositories queries the backend using a supplied key value, then returns the first record found without verifying that the stored key string matches the supplied value exactly. An attacker who submits a guessed or partial Deploykey value can therefore receive a matching key object if the backend search returns any record, bypassing the intended authorization check.

Root Cause

The root cause is improper authorization in the Deploykey lookup. The pre-patch logic in DynamodbRepository.java and CosmosDbRepository.java accepted the first result of findDeployKeys as a valid match. The backend query may return a key based on a non-exact comparison, so the method returned a Deploykey even when the supplied value did not equal the stored getKey() value. No string equality check was performed before issuing write privileges.

Attack Vector

The attack is exploitable over the network without authentication or user interaction. An attacker sends crafted requests to the Tapir registry endpoints that consume a Deploykey value. When the lookup succeeds against a guessed input, the attacker obtains write access to the registry and can publish or modify Terraform modules consumed by downstream infrastructure-as-code pipelines.

java

// Security patch in DynamodbRepository.java - enforce exact match on Deploykey
public DeployKey getDeployKeyByValue(String value) throws DeployKeyNotFoundException {
    Collection<DeployKey> deployKeys = (Collection<DeployKey>) findDeployKeys("", 1, value).getEntities();
    if (deployKeys == null || deployKeys.isEmpty()) {
        throw new DeployKeyNotFoundException("Could not find matching key");
    }
    return deployKeys
        .stream()
        .filter(deployKey -> deployKey.getKey().equals(value)) // Ensure exact match
        .findFirst()
        .orElseThrow(() -> new DeployKeyNotFoundException("Could not find matching key"));
}
// Source: https://github.com/PacoVK/tapir/commit/c36360b611fa0ba4f5e250fa43ecf8a294785a03

Detection Methods for CVE-2024-56802

Indicators of Compromise

Unexpected Terraform module versions or providers published to the Tapir registry from unfamiliar source IP addresses.
High volume of failed or rapid sequential requests to Deploykey-authenticated endpoints, indicating key guessing.
Deploykey-authorized write operations originating outside normal CI/CD network ranges.

Detection Strategies

Audit Tapir application logs for repeated getDeployKeyByValue lookups with varying values from a single client.
Compare published module artifacts against expected CI/CD release manifests to identify unauthorized publishes.
Inspect the DynamoDB or CosmosDB Deploykey table access patterns for anomalous read frequencies.

Monitoring Recommendations

Forward Tapir runtime logs and cloud backend audit logs to a centralized analytics pipeline for correlation.
Alert on any Terraform module write operation outside approved maintenance windows or CI/CD identities.
Track Deploykey creation, rotation, and usage events to baseline normal access and surface deviations.

How to Mitigate CVE-2024-56802

Immediate Actions Required

Upgrade Tapir to version 0.9.2 or later, which enforces exact string equality on Deploykey lookups.
Rotate all existing Deploykeys after upgrading, treating prior keys as potentially exposed.
Review registry contents for unauthorized module versions and remove or republish affected artifacts.

Patch Information

The fix is published in the GitHub Security Advisory GHSA-rj9m-qf65-f5gg and applied in the upstream commit c36360b. The patch modifies getDeployKeyByValue in DynamodbRepository.java and CosmosDbRepository.java to add a filter(deployKey -> deployKey.getKey().equals(value)) step before returning a key.

Workarounds

Restrict network access to the Tapir registry to trusted CI/CD subnets until the upgrade to 0.9.2 is completed.
Temporarily disable scope-able Deploykey authentication and require alternative authenticated channels for registry writes.
Enforce strict ingress filtering and rate limiting on Deploykey-protected endpoints to slow guessing attempts.

bash

# Pin Tapir container image to the patched release
docker pull ghcr.io/pacovk/tapir:0.9.2

# Verify running version
curl -s https://<tapir-host>/health | jq '.version'