CyberRota Analysis
AI-GeneratedInfracost versions prior to 0.10.45 are vulnerable to a token disclosure issue where untrusted Terraform input can lead to the attachment of sensitive tokens to attacker-controlled hosts. This vulnerability primarily affects CI/CD environments that utilize Terraform, particularly during pull request workflows that involve untrusted input. Organizations using Infracost for cloud cost intelligence should prioritize upgrading to version 0.10.45 to mitigate the risk of token exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remote_variables_loader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destination hostname derived from untrusted Terraform input without confirming that it is the configured trusted host. When a CI run provides a token while scanning attacker-controlled Terraform, including pull_request_target or a same-repository pull request, an attacker can direct the request to an attacker-controlled host and disclose the token. Standard fork pull_request workflows without secrets are not exposed. This issue is fixed in version 0.10.45.