Server-Side Request Forgery in Terrascan by Tenable

CVE-2026-47357

What is CVE-2026-47357?

The Terrascan tool, up to version 1.18.3, is vulnerable to a Server-Side Request Forgery (SSRF) scenario via the 'remote_url' parameter in its remote directory scan endpoint when deployed in server mode. This flaw allows an unauthenticated attacker to specify an arbitrary HTTP URL which, due to insufficient validation, gets executed by the underlying go-getter module. This execution can lead to a malicious server redirecting the request to a 'file://' URL, resulting in potential local file disclosure. Additionally, the vulnerability compromises stored credentials as HttpGetter is configured to read from the '.netrc' file, exposing sensitive data to any attacker controlling the target host. Notably, Terrascan has been archived as of August 2023, hence no further security patches will be available.

References