PT-2023-6893 · Hashicorp+1 · Terraform+1

Lum14N · Published 2023-09-08 · Updated 2025-10-20 · CVE-2023-4782

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Terraform versions 1.0.8 through 1.5.6

Description The issue is related to arbitrary file write during the init operation when run on maliciously crafted Terraform configuration. This is due to incorrect restriction of the directory path name with limited access. The exploitation of this issue may allow an attacker to upload arbitrary files.

Recommendations For Terraform versions 1.0.8 through 1.5.6, update to Terraform 1.5.7 to resolve the issue. As a temporary workaround, consider restricting the use of the init operation on untrusted configurations until the update is applied.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

AZL-29705

BDU:2023-07910

CVE-2023-4782

GHSA-H626-PV66-HHM7

GO-2023-2055

Affected Products

Red Os

Terraform

References · 19

• https://osv.dev/vulnerability/GO-2023-2055 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-29705 · Vendor Advisory
• https://discuss.hashicorp.com/t/hcsec-2023-27-terraform-allows-arbitrary-file-write-during-init-operation/58082 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-4782 · Security Note
• https://osv.dev/vulnerability/GHSA-h626-pv66-hhm7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-4782 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07910 · Security Note
• https://github.com/hashicorp/terraform/commit/0f2314fb62193c4be94328cc026fcb7ec1e9b893 · Note
• https://github.com/hashicorp/terraform/pull/33745 · Note
• https://github.com/hashicorp/terraform/releases/tag/v1.5.7 · Note
• https://github.com/hashicorp/terraform · Note
• https://discuss.hashicorp.com/t/hcsec-2023-27-terraform-allows-roption-file-write-during-init-operation/58082 · Note
• https://vuldb.com/ru/?id.239267 · Note
• https://twitter.com/VulmonFeeds/status/1700249897402773734 · Twitter Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/uyazvimost-terraform-cve-2023-4782/?sphrase_id=1327000 · Note