An authentication bypass vulnerability in Atlantis allows unauthenticated attackers to steal GitHub App credentials, potentially leading to full repository compromise and malicious payload injection.

The application fails to perform a capability check or authentication on the /github-app/setup endpoint, which is used during the GitHub App installation flow. This allows an unauthenticated attacker to observe the redirect process and exfiltrate the application's RSA private key and webhook secret.

Successful exploitation of this vulnerability grants an attacker the ability to mint installation tokens and forge webhook payloads. This allows unauthorized actors to impersonate the GitHub App, potentially executing malicious Terraform plans, accessing private source code, or manipulating repository workflows. Given the CVSS score of 8.0, this represents a high-severity risk to the integrity and confidentiality of the entire infrastructure-as-code pipeline.

Immediate Action: Upgrade the Atlantis installation to a patched version (beyond 0.47.1) as provided by the vendor. Ensure that any GitHub App credentials that were potentially exposed are rotated immediately in the GitHub organization settings.

Proactive Monitoring: Monitor server access logs for anomalous requests to /github-app/setup or /github-app/exchange-code. Audit GitHub App audit logs for unexpected token generation or unauthorized repository activity.

Compensating Controls: Deploy a Web Application Firewall to restrict access to the /github-app/ endpoint to known, trusted internal IP addresses only. Implement network-level access controls to prevent external traffic from reaching the Atlantis setup endpoints.

Public Exploit Available: No

This is a critical security flaw that directly exposes sensitive cryptographic secrets used for automation identity. Organizations utilizing Atlantis must prioritize patching this vulnerability immediately to prevent unauthorized pipeline access. If an immediate update is not feasible, restrict access to the Atlantis web interface at the network level until the patch can be applied.