Infracost Token Exfiltration via Untrusted Terraform Host Redirection

Technical Analysis

The vulnerability resides in internal/hcl/remote_variables_loader.go and related request paths that handle Terraform Cloud, remote-plan, and Terragrunt registry lookups. When Infracost processes Terraform configuration, it extracts hostnames from that (potentially attacker-supplied) HCL and attaches a stored authentication token to outbound requests without first confirming the hostname matches the trusted, configured registry. In CI contexts using pull_request_target or same-repository pull requests where secrets are available, an attacker can submit Terraform code specifying a malicious hostname, causing the CI job to leak the Terraform Cloud/registry token to attacker infrastructure via SSRF-like token exfiltration. This crosses a trust boundary between untrusted repository content (analogous to untrusted tool/agent input in AI-agent pipelines) and privileged CI secrets, a pattern directly relevant to AI coding agents that autonomously scan or apply Terraform changes with embedded credentials.

Affected Systems

Infracost

Detection Signatures

• Outbound HTTPS requests from CI runners to non-standard/unexpected Terraform registry or Terraform Cloud hostnames
• Authorization headers containing Terraform Cloud/registry tokens sent to hosts outside the configured trusted host allowlist
• CI logs showing Infracost processing pull_request_target events with untrusted HCL diffs
• Unexpected DNS resolution to attacker-controlled domains during infracost breakdown/diff runs

Remediation Steps

1. 1

   Upgrade Infracost

   Update to Infracost version 0.10.45 or later, which validates destination hostnames against the trusted configured host before attaching tokens.

2. 2

   Restrict secret exposure in CI

   Avoid using pull_request_target with secret-bearing tokens when scanning untrusted forked or same-repo PR content; use environments that gate secret access behind manual approval.

3. 3

   Rotate exposed tokens

   Rotate any Terraform Cloud or registry tokens that were used in CI pipelines prior to patching, in case of prior exploitation.

4. 4

   Enforce host allowlisting

   Configure network egress controls or proxy allowlists so CI runners can only reach known Terraform Cloud/registry hosts.

5. 5

   Audit CI workflows

   Review CI logs for anomalous outbound connections coinciding with Infracost runs on external contributions.