Horizon Alert
Summary of the vulnerability and why it matters
Terrascan's server mode has a critical flaw that lets unauthenticated attackers read local files and steal credentials. This issue arises because the tool doesn't properly validate URLs provided for remote scans, allowing redirection to sensitive locations. Since Terrascan is no longer maintained, there will be no fix.
- Can read local files.
- Can steal stored credentials.
- Affects unauthenticated users.
Attack Path
How an attacker could exploit the issue
An unauthenticated remote attacker can exploit this vulnerability by sending a crafted request to a Terrascan server. The attacker's request will include a malicious URL pointing to their controlled server, which can then redirect Terrascan to read local files or leak credentials via the `.netrc` file. This is possible because Terrascan's remote directory scan endpoint lacks proper validation and passes the URL directly to a vulnerable library.
- No authentication required.
- Targets remote directory scan endpoint.
- Exploits `file://` redirection via HTTP headers.
- Leaks credentials via `.netrc` file.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability allows unauthenticated attackers to read local files or steal credentials by tricking Terrascan into fetching malicious URLs. The SSRF flaw leverages the `go-getter` library, which lacks proper validation for the `remote_url` parameter. Attackers can exploit this by redirecting the fetch to a `file://` URL or by leveraging Netrc to capture credentials.
- Affects unauthenticated attackers.
- Targets server mode without authentication.
- CVE disclosed in 2026.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize isolating or taking offline any instances of Terrascan v1.18.3 and prior running in server mode, as these are unauthenticated and vulnerable to SSRF. Review network egress logs for suspicious connections from Terrascan instances to unexpected internal or external resources, especially those indicating file access or credential exfiltration. Since the project is archived, focus on immediate containment and architectural removal rather than patching.
- Block network access to the Terrascan API.
- Remove Terrascan from the environment.
- Monitor for anomalous file access.
