Terrascan v1.18.3 and prior, when run in server mode, is vulnerable to SSRF due to its behavior of resolving external URLs referenced in uploaded ARM or CloudFormation templates using hashicorp/go-getter with default detectors enabled. An unauthenticated attacker can upload templates containing fields such as templateLink.uri, parametersLink.uri, or AWS::CloudFormation::Stack TemplateURL that point to attacker-controlled URLs. The server fetches these URLs, enabling SSRF and local file read via file:// URLs. This affects deployments binding to 0.0.0.0 with no authentication. Terrascan was archived in August 2023, and no official patch will be provided.

An unauthenticated remote attacker can exploit this SSRF vulnerability to make the Terrascan server fetch arbitrary URLs, including local file URLs, potentially leading to disclosure of sensitive local files. The vulnerability affects Terrascan running in server mode with no authentication, exposing the server to remote exploitation. The CVSS score is 7.5 (high severity) with impact primarily on confidentiality. There are no known exploits in the wild. Since Terrascan is archived, no patch will be released.

No official patch or fix will be released as Terrascan was archived in August 2023. Users should discontinue use of Terrascan in server mode or restrict access to the server to trusted users only. Avoid running Terrascan server bound to 0.0.0.0 without authentication. Consider migrating to alternative tools that are actively maintained and patched. Patch status is not applicable due to project archival.