HashiCorp Terraform Information Disclosure and Security Bypass

The German Federal Office for Information Security (BSI) has released an advisory regarding a security vulnerability in HashiCorp Terraform, tracked as CVE-2024-7956. This vulnerability permits a local attacker to circumvent existing security protections and gain unauthorized access to information managed by the platform. The vulnerability is tied to the handling of sensitive data within state files or local configuration environments. Because this attack requires local access to the system executing Terraform commands, the primary threat involves users or processes with local shell access attempting to escalate their information access beyond their authorized scope. Organizations using Terraform to manage infrastructure should evaluate local access controls to the directories where state files are stored and ensure that environment-level permissions are strictly enforced.

Impact

Successful exploitation allows local attackers to access sensitive credentials or infrastructure state data that should be protected, potentially leading to further compromise of managed infrastructure resources. This vulnerability specifically affects local installations of Terraform across Windows, Linux, and macOS environments.

Recommendation

• Implement strict file-system access controls (ACLs) on directories containing Terraform state files (*.tfstate) to limit read access to authorized service accounts only.
• Review local user permissions on CI/CD build agents or developer workstations that have access to Terraform deployment environments.
• Monitor for unauthorized access to state files using file integrity monitoring (FIM) or audit logging on host filesystems.
• Apply the latest security patches for HashiCorp Terraform as soon as they are released by the vendor to remediate CVE-2024-7956.