CVE-2018-1262: UAA privilege escalation across identity zones

Severity

Critical

Vendor

Cloud Foundry Foundation

Affected Cloud Foundry Products and Versions

• You are using uaa-release versions v57, v57.1 or v58
• You are using uaa versions 4.12.x or 4.13.x
• You are using cf-deployment versions v1.27.0 through v1.31.0

Description

UAA, versions 4.12.X and 4.13.X, introduced a feature which could allow privilege escalation across identity zones for clients performing offline validation. A zone administrator could configure their zone to issue tokens which impersonate another zone, granting up to admin privileges in the impersonated zone for clients performing offline token validation.

Mitigation

Users of affected versions should apply the following mitigations or upgrades:

• Releases that have fixed this issue include:
  • uaa-release versions 57.2, 58.1
  • uaa versions 4.12.2, 4.13.4

Credit

This issue was responsibly reported by the UAA team.

History

2018-05-14: Initial vulnerability report published.