Listen to this Post
Terragrunt’s `catalog` feature allows users to browse and manage OpenTofu/Terraform infrastructure modules across multiple Git repositories through a single interface. To enable this functionality, Terragrunt automatically clones each repository defined in the catalog configuration into a local working area. In affected versions prior to v1.1.1, the path selected for these cloning operations was calculated using a completely deterministic formula: joining the shared system temporary directory path with a prefix and the base64-encoded SHA1 hash of the target repository URL (<tmp>/catalog-<base64 sha1 of the repo URL>).
Because this formula relied exclusively on static parameters—namely the repository URL and standard system environment paths—any local user or process sharing the same host could easily calculate the exact directory path prior to the execution of terragrunt catalog. On multi-user environments or shared Continuous Integration (CI) runners where multiple local processes have write permissions to /tmp, a local adversary could pre-create a symbolic link at that predicted path. When a legitimate user executed terragrunt catalog, Terragrunt failed to check whether the target path was already a symlink. Consequently, Terragrunt followed the symbolic link outside of the intended temporary directory root, removed any existing directory matching the repository name at the destination, and cloned the fresh repository contents into that path—all executing with the standard user permissions of the victim running the binary.
DailyCVE Form:
Platform: Terragrunt
Version: < v1.1.1
Vulnerability: Symlink Following
Severity: Medium
date: 2024-11-15
Prediction: 2024-11-15
(end of form)
Analytics Under Heading What Undercode Say
Bash Commands and Code
Calculate predictable target temporary directory path for a catalog repo URL
REPO_URL="https://github.com/org/terraform-aws-module"
HASH=$(echo -n "$REPO_URL" | openssl dgst -sha1 -binary | base64 | tr -d '\n')
EXPECTED_TMP="/tmp/catalog-${HASH}"
echo "Calculated deterministic catalog path: ${EXPECTED_TMP}"
Defensive verification: check if path is a symbolic link prior to access
if [ -L "$EXPECTED_TMP" ]; then
echo "Warning: Target path is a symbolic link!"
fi
Exploit Mechanism (Educational Purposes)
The underlying issue stems from Insecure Temporary File Management combined with Symbolic Link Following (CWE-59 / CWE-377).
1. Path Prediction: The target directory path is derived deterministically from public inputs (<tmp>/catalog-<base64_sha1(repo_url)>).
2. Pre-creation: An attacker on a multi-user machine pre-creates a symlink at `/tmp/catalog-/home/victim/target_parent).
3. Execution & Deletion: When the victim runs terragrunt catalog, Terragrunt resolves the existing path, follows the symlink, deletes the existing `/home/victim/target_parent/<repoName>, and clones the repository into that location under the victim’s privileges.
Protection
Upgrade: Update Terragrunt to version v1.1.1 or later, where clone paths are generated non-deterministically with secure randomness and symlink checks.
Environment Isolation: Do not grant untrusted local users write permissions to the shared system temporary directory (/tmp).
TMPDIR Override: Set TMPDIR, TMP, or `TEMP` to a user-restricted directory (e.g., export TMPDIR=/tmp/user_$UID_private) before invoking terragrunt catalog.
Impact
Arbitrary File / Directory Deletion: Local deletion of directories named `
Unauthorized File Creation: Re-populating the target path with repository source code under the user’s execution context.
Scope Restriction: Requires local machine access on a multi-user or shared environment; cannot be exploited remotely.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
