THE DARK SIDE OF DOMAIN-SPECIFIC LANGUAGES: UNCOVERING NEW ATTACK TECHNIQUES IN OPA AND TERRAFORM

Summary from the TLDR InfoSec newsletter

Researchers from Tenable investigated the OPA policy-as-code language and the Terraform infrastructure-as-code language and discovered new attack techniques. When investigating OPA they found that data can be exfiltrated from IMDSv2 using the http.send function in Rego or via DNS tunneling if http.send is disabled. In Terraform, the team explored some known weaknesses in Terraform plans such as usage of the external, HTTP, or external data source as well as the local-exec and remote-exec provisioners. Tenable suggests only using trusted modules and policies, setting up cloud and application logging, limiting network access, and scanning to mitigate these risks.