Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability exists in the clean method of the fileManifest struct, located in internal/util/file.go. This function is responsible for cleaning up files listed in a .terragrunt-module-manifest file. The vulnerability arises because the file paths from the manifest are used in os.Remove calls without proper validation. This allows a maliciously crafted manifest file containing directory traversal paths to delete arbitrary files on the filesystem with the permissions of the user running terragrunt. The patch addresses this by introducing a new function, relPathInsideRoot, which ensures that the path to be deleted is within the expected module directory, and removeInsideRoot which uses os.OpenRoot to prevent symlink escapes. The initial fix also introduced dropDownloadedManifests in internal/runner/run/download_source.go to remove any manifest files from downloaded modules as a defense-in-depth measure.
github.com/gruntwork-io/terragrunt/internal/util.(*fileManifest).cleaninternal/util/file.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/gruntwork-io/terragrunt | go | < 1.0.4 | 1.0.4 |