Terraform Provider Ctfd
Monthly
The CTFd Terraform Provider (ctfer-io/terraform-provider-ctfd) writes the ctfd_team.password attribute into Terraform state as a non-sensitive value in versions 0.1.5 through 2.8.1, so anyone who can read that state file obtains the CTFd team password directly, without needing the state encryption password or any further decryption step. The exposure is access-gated rather than anonymous: the attacker must already be able to read the state (a shared or compromised host, a state file committed to version control or leaked through CI logs, or an exposed remote backend), which is reflected in the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N and a confidentiality-only impact limited to team passwords. The vendor addressed it in v2.8.2 by marking the schema attribute Sensitive, states that no workaround exists, and no public exploit code has been identified at time of analysis.
The CTFd Terraform Provider (ctfer-io/terraform-provider-ctfd) writes the ctfd_team.password attribute into Terraform state as a non-sensitive value in versions 0.1.5 through 2.8.1, so anyone who can read that state file obtains the CTFd team password directly, without needing the state encryption password or any further decryption step. The exposure is access-gated rather than anonymous: the attacker must already be able to read the state (a shared or compromised host, a state file committed to version control or leaked through CI logs, or an exposed remote backend), which is reflected in the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N and a confidentiality-only impact limited to team passwords. The vendor addressed it in v2.8.2 by marking the schema attribute Sensitive, states that no workaround exists, and no public exploit code has been identified at time of analysis.