CVE-2023-4782 Terraform Allows Arbitrary File Write During Init Operation
Attackers can write arbitrary files during Terraform init via malicious configs, potentially leading to code execution or data modification.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-4782?
CVE-2023-4782 is a medium-severity path traversal vulnerability in HashiCorp Terraform, published on 8 Sep 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Terraform version 1.0.8 through 1.5.6 allows arbitrary file write during the `init` operation if run on maliciously crafted Terraform configuration. This vulnerability is fixed in Terraform 1.5.7.
Weakness: CWE-22
Which versions are affected by CVE-2023-4782?
3 open source packages ship an affected version, including github.com/hashicorp/terraform. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/hashicorp/terraform Go | From 1.0.8 | 1.5.7 |
github.com/hashicorp/terraform Go | From 1.0.8 | 1.5.7 |
github.com/hashicorp/terraform Go | From 1.0.8 | 1.5.7 |
Products include Hashicorp Terraform.
How do I fix CVE-2023-4782?
Upgrade github.com/hashicorp/terraform to 1.5.7 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-4782 being exploited?
There is no known exploitation of CVE-2023-4782 in the wild and no public exploit code.
Other vulnerabilities in HashiCorp Terraform
- CVE-2018-9057 HashiCorp Terraform Amazon Web Services (AWS) uses an insecure PRNG
- CVE-2021-36230 Missing authorization in n/a
- CVE-2019-19316 Use of a Broken or Risky Cryptographic Algorithm in Terraform
- CVE-2025-13432 Terraform Enterprise state versions can be created by users with specific permissions without sufficient write access
Sources
Also known as AZL-29705, GHSA-h626-pv66-hhm7, GO-2023-2055.