Description

Terraform dependencies are not pinned, allowing a malicious actor to override the used components with malicious components without leaving a trace.

Impact

Override dependencies or component with malicious content.

Recommendation

Use mechanisms such as git-commits, or artifacts and hashes to verify the data integrity.

Threat

Anonymous attacker from Internet with write access to the provider releases.

Expected Remediation Time

⏱️ 15 minutes.

Details

Why

Terraform providers are installed as: json {4,8} required_providers { aws = { source = "hashicorp/aws" version = "~> 3.23.0" } cloudflare = { source = "cloudflare/cloudflare" version = "~> 2.20.0" } } not only they are not pinned, but also a version like 2.20.0 has no guarantees because a malicious actor with access to the provider release process can override tags with malicious content, changing the legit 2.20.0 for malicious 2.20.0 without us noticing

Requirements

Fixes