Severity

Medium

CVSS score: 6.8 (Medium) (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/S:U/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N)

Vendor

Cloud Foundry Foundation

Versions Affected

*Severity is Medium unless otherwise noted.

bpm-release

– All versions prior to v1.4.30

Description

setupBpmLogs follows symlink for bpm.log open and chown — container-to-host privilege escalation via /etc/shadow. 

A compromised process inside a bpm container can cause root to chown an arbitrary host file to vcap and append bpm JSON log lines to it. The chown alone lets the attacker take ownership of /etc/shadow and read every password hash on the host via the read-only /etc bind mount. This is a container-to-host confidentiality break affecting every bpm-managed job.

Mitigation

Users of affected products are strongly encouraged to follow the mitigations below.

The Cloud Foundry project recommends upgrading the following releases:

bpm-release

– Upgrade bpm-release versions to v1.4.30 or greater

Credit

n/a.

History

June 18th: Initial vulnerability report published.