Listen to this Post
The vulnerability exploits a flaw in the Go programming language’s standard library for .zip archive extraction (CVE-2024-xxxxx in Go, though not directly assigned to OpenTofu). When OpenTofu executes the `tofu init` command to install provider or module dependencies, it fetches and extracts archives from configured sources. A malicious actor can craft a .zip archive with specially designed file entries that cause excessive computational overhead during the extraction process. This is due to how the Go archive/zip library handles certain compressed metadata, leading to inefficient parsing algorithms consuming high CPU cycles. The attacker must control the source serving the .zip file, such as a custom module registry or a compromised server. Upon fetching this archive, OpenTofu’s dependency installation process enters a prolonged state of high CPU utilization while attempting to read the archive contents. This prevents `tofu init` from completing in a reasonable time, causing a denial-of-service condition for the OpenTofu process and potentially degrading system performance. The vulnerability is triggered before any code from the dependency is executed, as it occurs during the archive unpacking phase. It affects both provider packages and module distribution packages that use the .zip format. The issue is rooted in the upstream Go library, which was corrected in version 1.25.6, highlighting OpenTofu’s indirect dependency on this external component for core functionality.
Platform: OpenTofu
Version: < v1.11.4
Vulnerability: Denial of service
Severity: Medium
date: Not specified
Prediction: v1.11.4 patch
What Undercode Say:
Analytics
tofu version
tofu init -upgrade
curl -sSL https://get.opentofu.org/install.sh | bash
go version
find . -name ".zip" -exec unzip -l {} \;
How Exploit:
Attacker hosts malicious .zip archive for module/provider. User adds attacker source to configuration. User runs tofu init. High CPU usage from archive extraction causes DoS.
Protection from this CVE
Upgrade to OpenTofu v1.11.4. Verify dependency sources. Use manual artifact inspection. Update Go runtime to 1.25.6.
Impact:
Unauthenticated denial of service. High CPU usage during tofu init. System performance degradation. No code execution or data disclosure.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
