Severity

Critical

Vendor

Cloud Foundry Foundation

Affected Cloud Foundry Products and Versions

• Cloud Foundry Container Runtime (CFCR)
  • All versions prior to v0.28.0

Description

Cloud Foundry Container Runtime, versions prior to 0.28.0, deploys K8s worker nodes that contains a configuration file with IAAS credentials. A malicious user with access to the k8s nodes can obtain IAAS credentials allowing the user to escalate privileges to gain access to the IAAS account.

Mitigation

Users of affected products are strongly encouraged to follow the mitigations below. The Cloud Foundry project recommends upgrading the following releases:

• Cloud Foundry Container Runtime (CFCR)
  • Upgrade All versions to v0.28.0 or greater

Credit

This issue was responsibly reported by Swisscom.

History

2019-02-14: Initial vulnerability report published.