Terrascan versions 1.18.3 and earlier, when run in server mode, allow an unauthenticated attacker to send a POST request to the /v1/{iac}/{iacVersion}/{cloud}/remote/dir/scan endpoint with a crafted remote_url parameter pointing to an attacker‑controlled HTTP server. The remote_url is passed directly to the hashicorp/go‑getter library without validation, enabling the library’s HttpGetter to follow redirects that can include a file:// scheme, thereby reading arbitrary local files on the host. If the attacker’s server responds with an X‑Terraform‑Get header, go‑getter will download the file to the requested location, allowing local file read. Additionally, HttpGetter is configured with Netrc enabled, so stored credentials from the server’s ~/.netrc file are sent to any attacker‑controlled hostnames, exposing authentication information.

The issue affects Tenable’s Terrascan product in all releases prior to 1.18.3 when configured in server mode. Server mode causes the application to bind to 0.0.0.0 and expose a REST API with no authentication, which means any system that publicly exposes the API is directly vulnerable. The source code repository was archived in August 2023 and no further patches or updates will be released.

The vulnerability carries a CVSS score of 9.3, indicating critical severity. No EPSS data is available and the vulnerability is not listed in CISA KEV. Attackers can reach the SSRF vector from any externally reachable Terrascan instance, so exploitation is likely provided that the service is exposed to the Internet. The lack of authentication and default open binding reduces the effort required for an attack, making the risk more pronounced for exposed deployments.