Infracost Template Function Symlink Path Traversal (Arbitrary File Read)

Technical Analysis

The readFile, pathExists, isDir, and matchPaths functions in internal/config/template/parser.go perform a lexical filepath.Rel check combined with a leaf-only os.Lstat, neither of which resolves symlinks placed on intermediate path components. An attacker who can influence repository contents (e.g., via a pull request or compromised dependency) can place a directory symlink such as evil pointing outside the checkout root, causing subsequent file access under evil/file to escape the intended sandbox and read runner-accessible files such as credentials, tokens, or environment configuration. Because these template functions may be invoked automatically by AI coding agents or CI/CD pipelines processing untrusted repository content, the vulnerability crosses a trust boundary between repository-supplied data and the runner's file system context. The exfiltrated content is then rendered into generated configuration and displayed via the Infracost dashboard or PR comments, giving the attacker a readable exfiltration channel without needing direct system access, with impact amplified in workflows granting the runner access to secrets.

Affected Systems

Infracost

Detection Signatures

• Repository paths containing symlinked directories pointing outside the checkout root (e.g., 'evil -> /etc' or similar)
• Infracost template function calls (readFile, pathExists, isDir, matchPaths) resolving paths outside the expected project directory
• Unexpected file content (secrets, tokens, system files) appearing in Infracost-generated PR comments or dashboard output
• CI logs showing os.ReadFile or os.Lstat operations on paths traversing symlinked intermediate directories

Remediation Steps

1. 1

   Upgrade Infracost

   Update to Infracost version 0.10.45 or later, which fixes the symlink resolution logic in the template parser.

2. 2

   Resolve full path chains

   For custom or forked tooling, ensure path validation resolves all intermediate symlinks (e.g., via filepath.EvalSymlinks) rather than only checking the leaf component.

3. 3

   Restrict CI runner secret exposure

   Limit the secrets and credentials accessible to CI jobs that process untrusted repository content, using least-privilege service accounts and scoped tokens.

4. 4

   Sandbox untrusted repository processing

   Run cost-estimation or similar tooling against untrusted/forked PR content in isolated, secrets-free environments before merging.

5. 5

   Audit generated outputs

   Review Infracost dashboard and PR comment outputs for unexpected file content prior to trusting or publishing them.