{"id":86935,"date":"2026-04-13T00:31:44","date_gmt":"2026-04-13T00:31:44","guid":{"rendered":""},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-30T00:00:00","slug":"cve-2025-58445-atlantis-golang-application-information-disclosure-vulnerability","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-58445-atlantis-golang-application-information-disclosure-vulnerability\/","title":{"rendered":"CVE-2025-58445: Atlantis Golang Application Information Disclosure Vulnerability<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

This report explores a vulnerability in the Atlantis golang application, a self-hosted application used to listen for Terraform pull request events via webhooks. The vulnerability, identified as CVE-2025-58445, exposes detailed version information, leaving the application susceptible to potential exploitation. Known vulnerabilities associated with specific versions can be targeted by attackers, jeopardizing the system’s security posture.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-58445
\nSeverity: High (CVSS: 7.5)
\nAttack Vector: Network
\nPrivileges Required: None
\nUser Interaction: None
\nImpact: System compromise, data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

Atlantis Golang Application | All versions<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The exploit works by sending a request to the \/status endpoint of the Atlantis application. This endpoint publicly discloses detailed version information about the application, which could include known vulnerabilities. An attacker could use this information to identify and exploit these vulnerabilities, potentially compromising the system or causing data leakage.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

A conceptual example of how this vulnerability might be exploited is shown below. An attacker might send a GET request to the \/status endpoint to retrieve the version information:<\/p>\n

GET \/status HTTP\/1.1\nHost: atlantis.example.com<\/code><\/pre>\n
After receiving the version information, the attacker can then research known vulnerabilities for that specific version and plan an attack accordingly.<\/p>\n
Mitigation Guidance<\/strong><\/p>\n
Since there is currently no fix available for this issue, it is recommended to apply a vendor patch or use a Web Application Firewall (WAF) or Intrusion Detection System (IDS) as a temporary mitigation. These tools can help detect and prevent malicious traffic, providing an additional layer of security. Additionally, it is recommended to regularly check for updates and patches from the vendor.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview This report explores a vulnerability in the Atlantis golang application, a self-hosted application used to listen for Terraform pull request events via webhooks. The vulnerability, identified as CVE-2025-58445, exposes detailed version information, leaving the application susceptible to potential exploitation. Known vulnerabilities associated with specific versions can be targeted by attackers, jeopardizing the system’s security […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-86935","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t