CVE-2016-2165 Loggregator Request URL Paths

Severity

Medium

Vendor

Cloud Foundry Foundation, VMware Cloud Foundry

Versions Affected

• cf-release v231 and lower

Description

The Loggregator Traffic Controller endpoints are not cleansing request URL paths when they are invalid and is returning them in the 404 response. This could allow malicious scripts to be written directly into the 404 response.

Mitigation

Users of affected versions should apply the following mitigation:

• Upgrade to cf-release v233 [1] (cf-release v232 is not recommended for use)

Credit

IBM Security, CoreLogic

References

• [1] https://github.com/cloudfoundry/cf-release/releases/tag/v233

2016-Mar-23: Initial vulnerability report published to pivotal.io

2017-Sep-09: Initial vulnerability report published to cloudfoundry.org