CVE-2019-3787: UAA defaults email address to an insecure domain | Cloud Foundry

2019-05-14T00:00:00
ID CFOUNDRY:E286996F780D0177EE821508484CD686
Type cloudfoundry
Reporter Cloud Foundry
Modified 2019-05-14T00:00:00

Description

Severity

High

Vendor

Cloud Foundry Foundation

Affected Cloud Foundry Products and Versions

  • UAA Release (OSS)
    • All versions prior to v73.0.0

Description

Cloud Foundry UAA, versions prior to 73.0.0, falls back to appending “unknown.org” to a user’s email address when one is not provided and the user name does not contain an @ character. This domain is held by a private company, which leads to attack vectors including password recovery emails sent to a potentially fraudulent address. This would allow the attacker to gain complete control of the user’s account.

Mitigation

Users of affected products are strongly encouraged to follow the mitigations below. The Cloud Foundry project recommends upgrading the following releases:

  • UAA Release (OSS)
    • Upgrade All versions to v73.0.0 or greater

Credit

This issue was responsibly reported by Kristian Kraljic from SAP.

History

2019-05-14: Initial vulnerability report published.