Tenable Terrascan versions up to 1.18.3 are vulnerable to SSRF and file path injection, which could allow attackers to access sensitive internal resources.

This vulnerability involves multiple flaws, including Server-Side Request Forgery (CWE-918) and external control of file paths (CWE-73). These issues allow an unauthenticated attacker to induce the application to make unauthorized requests or access files in unauthorized spheres.

The ability to perform SSRF and manipulate file paths provides an attacker with a vector to probe internal networks, bypass firewalls, and potentially read sensitive configuration files or cloud metadata. With a CVSS score of 7.5 (High), this represents a critical risk to the security boundary of any environment utilizing Terrascan for infrastructure-as-code scanning.

Immediate Action: Review vendor guidance and apply available security updates for Terrascan. If no patch is currently available, restrict access to the service to authorized users only.

Proactive Monitoring: Review application logs for suspicious outbound requests to internal endpoints or unusual file access attempts originating from the Terrascan service.

Compensating Controls: Implement strict egress filtering on the host running Terrascan to prevent unauthorized connections to sensitive internal or cloud metadata services.

Public Exploit Available: No (exploit_available: false)

Given the potential for unauthorized access to internal resources, organizations should treat this vulnerability with high priority. Monitor Tenable’s official advisory channels and apply the recommended version update as soon as it becomes available.