Terraform Cross-Org Module File Disclosure via DownloadFile RPC: Unauth Access Summary

Vulnerability Summary: Cross-organization Terraform module file disclosure via provisioner daemon DownloadFile RPC Vulnerability Overview Vulnerability Name: Cross-organization Terraform module file disclosure (via Provisioner Daemon's DownloadFile RPC) Vulnerability Type: Unauthorized Access / File Disclosure CVSS Score: 8.6 (High) Description: - The handler in the provisioner daemon service allows an authenticated provisioner daemon to download Terraform module archive files belonging to other organizations, bypassing multi-tenant isolation. - An attacker with valid credentials can enumerate and download module code from any organization, which may contain sensitive information (such as API keys, credentials, etc.). - The vulnerability stems from the RPC failing to properly validate the organization to which the module belongs; it relies solely on and , both of which can be forged. Scope of Impact Affected Components: - RPC within the handler (located in the service) - All archive files ( format) identified by and Affected Versions: - → Fixed in - → Fixed in - → Fixed in Affected Entities: - Any user possessing provisioner daemon authentication credentials (e.g., or keys) - Users capable of enumerating and downloading module code from other organizations (even without authorization) Remediation Upgrade: - Upgrade to a version containing the fix (see "Fixed Versions" table) - For multi-organization environments, it is recommended that all users upgrade Temporary Mitigation: - Restrict provisioner daemon access (e.g., use keys with least privilege) - Avoid storing sensitive information (such as hard-coded keys) within module code Official Fix Details: - Fixed the organization isolation logic in the RPC to ensure only modules within the current organization can be downloaded POC / Exploitation Code No complete POC or exploitation code is provided on the page; only the vulnerability principle and attack path are described: > "Attackers must know the target and , values which are typically not publicly exposed." However, based on the description, the exploitation method is as follows (pseudocode illustration): ⚠️ Note: Actual exploitation requires valid authentication credentials and knowledge of the target module's and . --- ✅ Recommended Actions: 1. Immediately upgrade to the fixed version. 2. Audit existing module code to remove sensitive information. 3. Restrict the access scope of the provisioner daemon. 4. Monitor for anomalous module download activities.

Goal Reached Thanks to every supporter — we hit 100%!

Terraform Cross-Org Module File Disclosure via DownloadFile RPC: Unauth Access Summary

More from this source