Cloud Foundry Logo

CVE-2018-11083: BOSH accepts refresh token as access token


Share

CVE-2018-11083: BOSH accepts refresh token as access token

Severity

High

Vendor

Cloud Foundry Foundation

Affected Cloud Foundry Products and Versions

  • You are using bosh-release versions prior to:
    • v264 prior to v264.14.0
    • v265 prior to v265.7.0
    • v266 prior to v266.8.0
    • v267 prior to v267.2.0

Description

BOSH allows refresh tokens to be used as access tokens when using UAA for authentication. A remote attacker with an admin refresh token given by UAA can be used to access BOSH resources without obtaining an access token, even if their user no longer has access to those resources.

Mitigation

Users of affected versions should apply the following mitigations or upgrades:

  • Releases that have fixed this issue include:
    • bosh-release versions v264.14.0, v265.7.0, v266.8.0, v267.2.0

Credit

This issue was responsibly reported by Dr. Nic Williams, Stark and Wayne.

History

2018-10-03: Initial vulnerability report published.

Cloud Foundry Foundation Security Team Profile Image

Cloud Foundry Foundation Security Team, AUTHOR

SEE ALL ARTICLES