Collected research

Terraform Plan “RCE”

alxk · alxk's blog

Explains why running Terraform plan on untrusted pull requests can execute code in privileged CI: custom providers or the external data provider launch programs, while ordinary providers may exfiltrate variables through lookups. It recommends restricting plugins, using read-only roles, and avoiding production plans before review.

Record

Researcher

alxk

Published by

alxk's blog

In the archive

• Collected in the 2021 research round

Tags

• ci-cd
• rce
• supply-chain
• credential-exposure
• data-exfiltration
• trust-boundary
• mitigation
• owasp-a06-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of alxk, first published at the original source. Preserved copies are kept so the citation survives its host.