Summary
Atlantis passes a pull-request-controlled workspace value into Terraform command arguments and executes the resulting command through a shell. An authenticated contributor whose pull request is eligible for an Atlantis plan may inject shell metacharacters and execute arbitrary commands as the Atlantis service account.
Atlantis passes a pull-request-controlled workspace value into Terraform command arguments and executes the resulting command through a shell. An authenticated contributor whose pull request is eligible for an Atlantis plan may inject shell metacharacters and execute arbitrary commands as the Atlantis service account.
Affected context
The vulnerability occurs in Atlantis deployments that process Terraform pull requests and derive workspace values from pull-request-controlled atlantis.yaml content. It is relevant when those values are incorporated into shell commands without reliable argument separation or shell-safe handling. Fork-based exploitation additionally depends on the deployment permitting fork pull requests, while eligible branches from the same repository may reach the vulnerable path without that setting.
The vulnerability occurs in Atlantis deployments that process Terraform pull requests and derive workspace values from pull-request-controlled atlantis.yaml content. It is relevant when those values are incorporated into shell commands without reliable argument separation or shell-safe handling. Fork-based exploitation additionally depends on the deployment permitting fork pull requests, while eligible branches from the same repository may reach the vulnerable path without that setting.
Exploit preconditions
- Attack surface: Atlantis webhook and pull-request planning workflow
- Required access: Authenticated contributor access sufficient to submit an eligible pull request
- Trigger point: Terraform command construction during an Atlantis plan
- Input under attacker influence: The workspace value supplied through
atlantis.yaml - Why exploitation is possible: Pull-request-controlled data is joined into a command string and interpreted by
sh -c, allowing shell metacharacters to alter command execution - Additional deployment condition: Fork exploitation requires fork pull requests to be enabled
- Attack surface: Atlantis webhook and pull-request planning workflow
- Required access: Authenticated contributor access sufficient to submit an eligible pull request
- Trigger point: Terraform command construction during an Atlantis plan
- Input under attacker influence: The workspace value supplied through
atlantis.yaml - Why exploitation is possible: Pull-request-controlled data is joined into a command string and interpreted by
sh -c, allowing shell metacharacters to alter command execution - Additional deployment condition: Fork exploitation requires fork pull requests to be enabled
Why this happens
The underlying flaw is command construction from untrusted input followed by shell interpretation. Atlantis incorporates a workspace value into Terraform arguments with string joining and then invokes the result through sh -c, allowing data intended as an argument to become shell syntax. This behavior maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, commonly called OS command injection.
The underlying flaw is command construction from untrusted input followed by shell interpretation. Atlantis incorporates a workspace value into Terraform arguments with string joining and then invokes the result through sh -c, allowing data intended as an argument to become shell syntax. This behavior maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, commonly called OS command injection.
Potential impact
- Arbitrary command execution as the Atlantis service account
- Exposure of cloud-provider, Terraform, or version-control credentials
- Access to files, Terraform state, and network resources available to the service
- Modification of repositories, infrastructure plans, or workspace data
- Lateral movement into connected systems
- Possible disruption or compromise of infrastructure managed through Atlantis
- Arbitrary command execution as the Atlantis service account
- Exposure of cloud-provider, Terraform, or version-control credentials
- Access to files, Terraform state, and network resources available to the service
- Modification of repositories, infrastructure plans, or workspace data
- Lateral movement into connected systems
- Possible disruption or compromise of infrastructure managed through Atlantis
General mitigation guidance
Mitigation should focus on preventing pull-request-controlled values from becoming shell syntax.
Common defensive patterns include:
- Invoke Terraform and related tools directly with argument arrays rather than constructing shell command strings
- Avoid
sh -cfor values that originate from repositories, pull requests, or other untrusted sources - Validate workspace names against a strict allowlist or constrained format before use
- Treat repository configuration and fork content as untrusted input
- Run Atlantis with a dedicated least-privilege service account and narrowly scoped credentials
- Restrict filesystem, network, token, and cloud permissions available to the Atlantis process
- Use isolated execution environments for pull-request plans and prevent unnecessary secret exposure
- Apply secure-by-default policies that disable untrusted fork execution unless explicitly required
Mitigation should focus on preventing pull-request-controlled values from becoming shell syntax.
Common defensive patterns include:
- Invoke Terraform and related tools directly with argument arrays rather than constructing shell command strings
- Avoid
sh -cfor values that originate from repositories, pull requests, or other untrusted sources - Validate workspace names against a strict allowlist or constrained format before use
- Treat repository configuration and fork content as untrusted input
- Run Atlantis with a dedicated least-privilege service account and narrowly scoped credentials
- Restrict filesystem, network, token, and cloud permissions available to the Atlantis process
- Use isolated execution environments for pull-request plans and prevent unnecessary secret exposure
- Apply secure-by-default policies that disable untrusted fork execution unless explicitly required
How teams detect issues like this
Detection approaches can include:
- Static analysis rules identifying
sh -c, shell command construction, or string joining of user-controlled values - Code review checks for repository or pull-request fields flowing into process execution APIs
- Tests using shell metacharacter cases to verify that workspace and other configuration values remain data
- Runtime monitoring for unexpected child processes, command interpreters, credential access, or network connections from Atlantis
- Policy enforcement requiring direct process invocation, strict input schemas, and least-privilege execution
- Automated security review tools configured to flag command injection data-flow patterns
Detection approaches can include:
- Static analysis rules identifying
sh -c, shell command construction, or string joining of user-controlled values - Code review checks for repository or pull-request fields flowing into process execution APIs
- Tests using shell metacharacter cases to verify that workspace and other configuration values remain data
- Runtime monitoring for unexpected child processes, command interpreters, credential access, or network connections from Atlantis
- Policy enforcement requiring direct process invocation, strict input schemas, and least-privilege execution
- Automated security review tools configured to flag command injection data-flow patterns
