Severity

Medium

Vendor

Cloud Foundry Foundation

Affected Cloud Foundry Products and Versions

• CredHub CLI
  • All versions prior to 2.2.1

Description

Cloud Foundry CredHub CLI, versions prior to 2.2.1, inadvertently writes authentication credentials provided via environment variables to its persistent config file. A local authenticated malicious user with access to the CredHub CLI config file can use these credentials to retrieve and modify credentials stored in CredHub that are authorized to the targeted user.

Mitigation

Users of affected products are strongly encouraged to follow the mitigations below. The Cloud Foundry project recommends upgrading the following releases:

• CredHub CLI
  • Upgrade All versions to 2.2.1 or greater

Credit

This issue was responsibly reported by StubHub.

History

2019-03-04: Updated credit section.

2019-02-11: Initial vulnerability report published.