Go · github.com/infracost/infracost
Infracost: Arbitrary file read via config-template readFile symlink traversal
Path traversal via link following in the Infracost config-template parser. The readFile, pathExists, isDir, and matchPaths template functions confined repo-supplied paths with a lexical filepath.Rel check plus a leaf-only os.Lstat:
{{ readFile "evil/file" }}
With an intermediate directory symlink committed in the repo (evil -> /), the path is lexically clean and the leaf is a regular file, so both checks pass, but os.ReadFile follows the symlink and reads outside the checkout. The contents are rendered into the generated config and surfaced via the Infracost dashboard and PR comment, so anyone who can open a pull request can read files off the runner.
Affects infracost up to and including v0.10.44. Successful exploitation reads any file the CLI process can reach on the runner. Impact depends on what the run exposes: under on: pull_request (the configuration in Infracost's documentation) fork pull requests run without secrets and with a read-only token, so exposure is limited. If Infracost runs under pull_request_target, or is triggered by a same-repository pull request, the read reaches the repository's secrets, enabling secret theft. The patch confines all four functions regardless of trigger.
Fixed in v0.10.45 (#3586) by routing all four functions through security.IsPathAllowed, which resolves symlinks anywhere in the path before a segment-aware containment check. The same fix landed in config#14 and parser#144.
latest Docker tag: upgrade to v0.10.45 (or later) to receive the fix.v0.10.45.No full fix without upgrading. To limit exposure: run Infracost under on: pull_request rather than pull_request_target, and keep fork pull requests from receiving secrets (the defaults).
Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.