Gardener provider extensions vulnerable to code injection when Terraform is used for infrastructure provisioning in github.com/gardener/gardener-extension-provider-aws

The code injection vulnerability in gardener.com/gardener-extension-provider-aws poses a significant threat. An attacker who can influence the Terraform provisioning process can inject arbitrary code into the infrastructure being created. This could lead to complete system compromise, including unauthorized access to sensitive data, modification of system configurations, and the potential for lateral movement within the Gardener cluster. The impact is particularly severe because Terraform is often used for automated infrastructure deployment, making it a prime target for attackers seeking to gain control over the entire environment. Successful exploitation could allow an attacker to establish a persistent foothold and exfiltrate sensitive information.

Organizations utilizing Gardener with the AWS extension provider for infrastructure provisioning are at risk. This includes teams heavily reliant on Terraform for automated deployments and those with less stringent input validation practices within their Terraform configurations. Shared hosting environments or deployments where Terraform state files are not adequately secured are particularly vulnerable.

• go / supply-chain:

find /opt/go/src/github.com/gardener/gardener-extension-provider-aws -name '*.go' -print0 | xargs -0 grep -i 'terraform.NewResource' 

• generic web:

curl -I https://<your-gardener-endpoint>/api/v1/extensionproviders/aws | grep -i 'server:'

1. 2025-10-23Disclosure

   disclosure

1. Reserviert2025-09-22
2. Veröffentlicht2025-10-23
3. Geändert2026-03-03
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-59823 is to immediately upgrade to version 1.64.0 or later of gardener.com/gardener-extension-provider-aws. If an immediate upgrade is not feasible due to compatibility concerns or breaking changes, consider implementing stricter input validation and sanitization within your Terraform configurations to prevent malicious code from being injected. Review and audit all Terraform templates and scripts used for infrastructure provisioning. Additionally, restrict access to Terraform state files to prevent unauthorized modifications. After upgrading, verify the fix by attempting to trigger a Terraform provisioning process with a known malicious payload and confirming that it is properly sanitized and rejected.