Impact

Exploitation of this vulnerability allows an attacker with local access to conduct unauthorized network requests from the context of the Checkov process. This could potentially allow access to sensitive internal network services or metadata endpoints not otherwise reachable by the attacker. Palo Alto Networks is currently unaware of any in-the-wild exploitation.

Recommendation

• Upgrade Checkov by Prisma Cloud to version 3.4.2 or later.
• Audit existing Checkov deployments to determine if the '--download-external-modules' option is enabled.
• Implement a policy to avoid running Checkov scans over untrusted source content.
• Pass configuration parameters explicitly through trusted configuration files instead of allowing them to be auto-loaded from scanned directories.