Atlantis
Monthly
The /github-app/setup endpoint in Atlantis through 0.47.1 is completely unauthenticated, exposing GitHub App credentials-including the RSA private key and webhook secret-to any network caller who reaches the endpoint during a setup session. Successful exploitation grants an attacker the ability to mint valid GitHub App installation tokens and forge webhook payloads, effectively compromising the trust chain between Atlantis and all GitHub repositories managed through that App installation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the credential class exposed makes this a high-priority remediation for any internet-exposed Atlantis instance using GitHub App authentication.
Path traversal in Atlantis workspace handling (versions 0.19.8 through 0.44.x) allows authenticated users to escape the intended workspace directory boundary, triggering os.RemoveAll and os.MkdirAll operations on arbitrary filesystem paths with Atlantis process privileges. A crafted workspace value such as '../../../../../../../../tmp/f1-canary' - supplied via repository atlantis.yaml or authenticated /api/plan API input - causes Atlantis to operate on out-of-bounds directories before Terraform rejects the invalid workspace name. A working proof-of-concept is documented in GHSA-26w5-6g95-gj28; the vulnerability is not in CISA KEV and no public exploit kit has been identified at time of analysis.
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 are vulnerable to Timing Attack in the webhook event validator code, which does not use a constant-time comparison. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The /github-app/setup endpoint in Atlantis through 0.47.1 is completely unauthenticated, exposing GitHub App credentials-including the RSA private key and webhook secret-to any network caller who reaches the endpoint during a setup session. Successful exploitation grants an attacker the ability to mint valid GitHub App installation tokens and forge webhook payloads, effectively compromising the trust chain between Atlantis and all GitHub repositories managed through that App installation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the credential class exposed makes this a high-priority remediation for any internet-exposed Atlantis instance using GitHub App authentication.
Path traversal in Atlantis workspace handling (versions 0.19.8 through 0.44.x) allows authenticated users to escape the intended workspace directory boundary, triggering os.RemoveAll and os.MkdirAll operations on arbitrary filesystem paths with Atlantis process privileges. A crafted workspace value such as '../../../../../../../../tmp/f1-canary' - supplied via repository atlantis.yaml or authenticated /api/plan API input - causes Atlantis to operate on out-of-bounds directories before Terraform rejects the invalid workspace name. A working proof-of-concept is documented in GHSA-26w5-6g95-gj28; the vulnerability is not in CISA KEV and no public exploit kit has been identified at time of analysis.
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 are vulnerable to Timing Attack in the webhook event validator code, which does not use a constant-time comparison. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.