Password Disclosure

cloudfoundry is vulnerable to Password Disclosure. The vulnerability exists when kernel audit logging is enabled, which logs every command run on a VM, causing authentication commands of the form cf auth --client-credentials USERNAME PASSWORD to be logged in plaintext to syslog, allowing an...

Denial Of Service (DoS)

github.com/cloudfoundry/gorouter is vulnerable to Denial of Service DoS. The vulnerability is due to premature connection closures, which results in the removal of the selected backend from the routing pool when the application is hosted on Cloud Foundry...

CVE-2018-25046

A flaw was found in the cloudfoundry/archiver package. In affected versions of this package, archives containing relative file paths can cause files to be written or overwritten outside of the target directory due to improper path sanitization...

CVE Report Published for Spring Tools

We have released STS 4.16.1 for Eclipse and Spring VSCode extensions 1.40.0 to address the following CVE report: - CVE-2022-31691: Remote Code Execution via YAML editors in STS4 extensions for Eclipse and VSCode Please review the information in the CVE report and upgrade immediately. Eclipse: STS...

PT-2022-20891 · Spring · Spring Boot Tools +1

Name of the Vulnerable Software and Affected Versions: Spring Tools 4 for Eclipse version 4.16.0 and below Spring Boot Tools version 1.39.0 and below Concourse CI Pipeline Editor version 1.39.0 and below Bosh Editor version 1.39.0 and below Cloudfoundry Manifest YML Support version 1.39.0 and bel...

Remote Code Execution via YAML editors in STS4 extensions for Eclipse and VSCode

Spring Tools 4 for Eclipse version 4.16.0 and below as well as VSCode extensions such as Spring Boot Tools, Concourse CI Pipeline Editor, Bosh Editor and Cloudfoundry Manifest YML Support version 1.39.0 and below all use Snakeyaml library for YAML editing support. This library allows for some...

Denial Of Service (DoS)

github.com/cloudfoundry/gorouter is vulnerable to denial of service DoS. The vulnerability exists as it fails to return an unknown failure error when panics occur through cf push requests...

Denial Of Service (DoS)

github.com/cloudfoundry/cf-deployment is vulnerable to denial of service DoS. The vulnerability exists as the routing-release dependency used contained GoRouter. This allows invalid headers to be sent, to cause caching layers to reject subsequent clients...

GSA Bounty: Cache poisoning DoS to various TTS assets

I have recently come across a technique to force a Cloudfoundry app to return a HTTP 404 error when requesting any resource, which contains cache friendly headers. What this means is, if the Cloudfoundry app in question is behind a web cache like Cloudfront or Cloudflare etc, it will possibly sto...

Information Disclosure

cloudfoundry-identity-server is vulnerable to information disclosure. A remotely authenticated attacker with scim.invite scope is able to obtain information about users of the UAA via blind SCIM injection through the email parameter...

Information Disclosure

github.com/cloudfoundry/smbdriver is vulnerable to information disclosure. Confidential information such as volume usernames and passwords are written into the SMB volume logs, allowing a remote user with access to the logs to retrieve the credentials and gain access to the SMB volumes of other...

Privilege Escalation

cloudfoundry-identity-server is vulnerable to privilege escalation. External input is directly appended to an SCIM query, allowing a remote attacker with client.write and groups.update to inject and execute a malicious SCIM query. This allows the retrieval of confidential information that allows ...

Cross-site Scripting (XSS)

cloudfoundry-identity-scim is vulnerable to cross-site scripting XSS. The vulnerability exists through the lack of sanitization of filter in the returned ScimException...

Clickjacking

cloudfoundry-identity-server is vulnerable to clickjacking attacks. It was discovered that it does not use content security policy X-FRAME-OPTIONS header on various email-endpoints which made it possible to intercept and manipulate requests. An attacker could use this flaw to trick a user into...

Information Disclosure

cloudfoundry-identity-server is vulnerable to information disclosure. The vulnerability exists as it defaults to sending emails to @unknown.org if a user's email address is not provided, allowing the owner of the unknown.org domain to receive password recovery emails of other users...

Man-in-the-Middle (MitM)

github.com/cloudfoundry/cf-deployment is vulnerable to man-in-the-middle attacks. Dependencies are downloaded via an unencrypted HTTP channel, allowing man-in-the-middle attackers to modify contents of the dependencies that are downloaded by the application, potentially causing arbitrary code...

Open Redirection

Cloudfoundry UAA is vulnerable to open redirection.The redirect URI is not properly validated to filter wildcard characters, allowing a remote unauthenticated user to enter malicious URI to get a UAA access code...

Privilege Escalation

cloudfoundry-identity-server is vulnerable to privilege escalation attacks. The vulnerability exists due to an error in validation, allowing an authenticated user to gain an OAuth token with arbitrary scopes by modifying the url and content of the consent page...

Authorization Bypass

cloudfoundry-identity-server is vulnerable to authorization bypasses. A malicious user can use a refresh token to gain access to the application instead of using an access token, allowing them to stay authenticated longer...

Man-in-the-Middle (MitM)

github.com/cloudfoundry/gorouter is vulnerable to man-in-the-middle MitM attacks. The vulnerability exists due to the lack of validation on the value of the X-Forwarded-Proto header, allowing the client to use a http connection and be prone to MitM attacks...