CVE-2017-4992: Privilege escalation with user invitations
Severity
Critical
Vendor
Cloud Foundry Foundation
Versions Affected
- cf-release versions prior to v261
- UAA release:
- 2.x versions prior to v2.7.4.17
- 3.6.x versions prior to v3.6.11
- 3.9.x versions prior to v3.9.13
- Other versions prior to v4.2.0
- UAA bosh release (uaa-release):
- 13.x versions prior to v13.15
- 24.x versions prior to v24.10
- 30.x versions prior to 30.3
- Other versions prior to v37
Description
Any user or client can access the invitations endpoint to generate a code and perform a password reset for a different user in the system.
Mitigation
Users of affected versions should apply the following mitigation or upgrade:
- Upgrade to Cloud Foundry v261 [1] or later
- For standalone UAA users:
- For users using UAA Version 3.0.0 – 3.17.0, please upgrade to UAA Release to v3.18.0 [2] or v3.9.13 [3] or v3.6.11 [4]
- For users using standalone UAA Version 2.X.X, please upgrade to UAA Release to v2.7.4.17 [5]
- For users using UAA-Release (UAA bosh release), please upgrade to UAA-Release v30.3 [6] if upgrading to v3.18.0 [2] or v24.10 [7] if upgrading to v3.9.13 [3] and v13.15 [8] if upgrading to v3.6.11 [4]
- For users using the latest version, please upgrade to v37 [9].
Credit
This vulnerability was responsibly reported by the GE Digital Security Team.
References
- [1] https://github.com/cloudfoundry/cf-release/releases
- [2] https://github.com/cloudfoundry/uaa/releases/tag/3.18.0
- [3] https://github.com/cloudfoundry/uaa/releases/tag/3.9.13
- [4] https://github.com/cloudfoundry/uaa/releases/tag/3.6.11
- [5] https://github.com/cloudfoundry/uaa/releases/tag/2.7.4.17
- [6] http://bosh.io/releases/github.com/cloudfoundry/uaa-release?version=30.3
- [7] http://bosh.io/releases/github.com/cloudfoundry/uaa-release?version=24.10
- [8] http://bosh.io/releases/github.com/cloudfoundry/uaa-release?version=13.15
- [9] http://bosh.io/releases/github.com/cloudfoundry/uaa-release?version=37
History
2017-05-19: Initial vulnerability report published
