terraformrc-credentials-exposure: Terraform CLI Configuration - Credentials Exposure

id: terraformrc-credentials-exposure

info:
  name: Terraform CLI Configuration - Credentials Exposure
  author: ChrisJr404
  severity: high
  description: |
    A Terraform CLI configuration file (.terraformrc or terraform.rc) containing a credentials block was found exposed. This file stores API tokens used to authenticate the Terraform CLI to remote backends such as Terraform Cloud or Terraform Enterprise, so exposure can leak a valid token that grants access to remote state and workspaces.
  reference:
    - https://developer.hashicorp.com/terraform/cli/config/config-file
    - https://developer.hashicorp.com/terraform/cli/config/config-file#credentials
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cwe-id: CWE-522
  metadata:
    max-request: 2
    google-query: intitle:"index of" ".terraformrc"
  tags: exposure,config,terraform,iac,token

http:
  - method: GET
    path:
      - "{{BaseURL}}/.terraformrc"
      - "{{BaseURL}}/terraform.rc"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - 'credentials\s+"[^"]+"\s*\{'
          - 'token\s*=\s*"'
        condition: and

      - type: word
        part: header
        words:
          - "text/html"
        negative: true

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        part: body
        group: 1
        regex:
          - 'credentials\s+"([^"]+)"'
# digest: 4a0a00473045022100a5498d00a883722551117f8af265bf151bb34c1f0a17a2a9506011dd0f3eeeb50220372c6c82be35bfabb15e1823733b53aa8f01c3d5b4479da16fd408a075e005c9:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.