Summary
Atlantis versions >= 0.19.8 and < 0.45.0 did not consistently validate user-controlled workspace values before using them to construct local workspace paths.
A crafted workspace value containing path traversal segments could cause Atlantis to resolve workspace paths outside the intended per-pull workspace directory. In vulnerable versions or code paths, Atlantis could create, use, or remove/recreate out-of-bounds directories with the privileges of the Atlantis process user, before Terraform rejected the invalid workspace name.
The issue is fixed in Atlantis 0.45.0.
Details
The issue is a path traversal vulnerability in Atlantis workspace handling. workspace values can be supplied through repository-level atlantis.yaml configuration accepted by the server or through authenticated API input. A value such as ../../../../../../../../tmp/f1-canary could escape the intended Atlantis workspace root.
In affected code paths, Atlantis used the resolved workspace path for local working-directory operations. For example, workspace values were joined into repo pull paths, and clone preparation paths could call directory removal/recreation operations such as os.RemoveAll and os.MkdirAll on the resolved directory.
PoC
In a local PoC using repo-level atlantis.yaml, the following workspace value caused Atlantis to resolve and use /tmp/f1-canary outside ~/.atlantis/repos/...:
version: 3
projects:
- dir: .
workspace: ../../../../../../../../tmp/f1-canaryAtlantis logs showed the out-of-bounds directory being created and Terraform being run with /tmp/f1-canary as the working directory. Terraform rejected the workspace name only after Atlantis had already used the out-of-bounds path.
Impact
A user who can cause Atlantis to process a crafted workspace value, for example through repository-level atlantis.yaml configuration accepted by the server or an authenticated /api/plan request, may cause filesystem operations to occur outside the intended workspace boundary.
Depending on the affected version, code path, deployment configuration, and filesystem permissions, this may result in unintended directory creation, deletion, or reuse, integrity impact to writable local paths, or denial of service. Containerized deployments may limit host impact, but writable mounted volumes and persistent Atlantis data paths remain relevant.
Summary
Atlantis versions
>= 0.19.8and< 0.45.0did not consistently validate user-controlledworkspacevalues before using them to construct local workspace paths.A crafted workspace value containing path traversal segments could cause Atlantis to resolve workspace paths outside the intended per-pull workspace directory. In vulnerable versions or code paths, Atlantis could create, use, or remove/recreate out-of-bounds directories with the privileges of the Atlantis process user, before Terraform rejected the invalid workspace name.
The issue is fixed in Atlantis
0.45.0.Details
The issue is a path traversal vulnerability in Atlantis workspace handling.
workspacevalues can be supplied through repository-levelatlantis.yamlconfiguration accepted by the server or through authenticated API input. A value such as../../../../../../../../tmp/f1-canarycould escape the intended Atlantis workspace root.In affected code paths, Atlantis used the resolved workspace path for local working-directory operations. For example, workspace values were joined into repo pull paths, and clone preparation paths could call directory removal/recreation operations such as
os.RemoveAllandos.MkdirAllon the resolved directory.PoC
In a local PoC using repo-level
atlantis.yaml, the following workspace value caused Atlantis to resolve and use/tmp/f1-canaryoutside~/.atlantis/repos/...:Atlantis logs showed the out-of-bounds directory being created and Terraform being run with
/tmp/f1-canaryas the working directory. Terraform rejected the workspace name only after Atlantis had already used the out-of-bounds path.Impact
A user who can cause Atlantis to process a crafted
workspacevalue, for example through repository-levelatlantis.yamlconfiguration accepted by the server or an authenticated/api/planrequest, may cause filesystem operations to occur outside the intended workspace boundary.Depending on the affected version, code path, deployment configuration, and filesystem permissions, this may result in unintended directory creation, deletion, or reuse, integrity impact to writable local paths, or denial of service. Containerized deployments may limit host impact, but writable mounted volumes and persistent Atlantis data paths remain relevant.