6.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2023-4782

CVE-2023-4782: Terraform allows arbitrary file write during the `init` operation

Terraform version 1.0.8 through 1.5.6 allows arbitrary file write during the init operation if run on maliciously crafted Terraform configuration. This vulnerability is fixed in Terraform 1.5.7.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2023-4782

CVE-2023-4782:

6.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/hashicorp/terraform	go	>= 1.0.8, < 1.5.7	1.5.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows arbitrary file write during the init operation due to improper validation of module names. The provided commit 0f2314fb62193c4be94328cc026fcb7ec1e9b893 directly addresses this by adding validation for module names within the moduleInstallWalker function in internal/initwd/module_install.go. Specifically, the patch introduces a check if !hclsyntax.ValidIdentifier(req.Name) before the module name is used to determine the installation path via i.packageInstallPath(req.Path). This indicates that moduleInstallWalker was the function processing the potentially malicious input (module name) without sufficient validation, and packageInstallPath was likely involved in constructing the file path that could be manipulated. The commit message further supports this by stating that module names were not validated before installation, potentially causing issues if the name couldn't be converted to a valid path. Therefore, moduleInstallWalker is identified as the primary vulnerable function, and packageInstallPath as a related function involved in the vulnerable operation.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.