Cloudfoundry Cf Deployment
By the Year
In 2023 there have been 4 vulnerabilities in Cloudfoundry Cf Deployment with an average score of 7.1 out of ten. Last year Cf Deployment had 1 security vulnerability published. That is, 3 more vulnerabilities have already been reported in 2023 as compared to last year. However, the average CVE base score of the vulnerabilities in 2023 is greater by 1.80.
Year | Vulnerabilities | Average Score |
---|---|---|
2023 | 4 | 7.10 |
2022 | 1 | 5.30 |
2021 | 4 | 6.90 |
2020 | 8 | 7.00 |
2019 | 8 | 7.24 |
2018 | 7 | 7.41 |
It may take a day or so for new Cf Deployment vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Cloudfoundry Cf Deployment Security Vulnerabilities
Cloud foundry routing release versions prior to 0.278.0 are vulnerable to abuse of HTTP Hop-by-Hop Headers
CVE-2023-34041
5.3 - Medium
- September 08, 2023
Cloud foundry routing release versions prior to 0.278.0 are vulnerable to abuse of HTTP Hop-by-Hop Headers. An unauthenticated attacker can use this vulnerability for headers like B3 or X-B3-SpanID to affect the identification value recorded in the logs in foundations.
In Cloud foundry routing release versions
CVE-2023-20882
5.9 - Medium
- May 26, 2023
In Cloud foundry routing release versions from 0.262.0 and prior to 0.266.0,a bug in the gorouter process can lead to a denial of service of applications hosted on Cloud Foundry. Under the right circumstances, when client connections are closed prematurely, gorouter marks the currently selected backend as failed and removes it from the routing pool.
Cloud foundry instances having CAPI version between 1.140 and 1.152.0 along with loggregator-agent v7+ may override other users syslog drain credentials if they're aware of the client certificate used for
CVE-2023-20881
8.1 - High
- May 19, 2023
Cloud foundry instances having CAPI version between 1.140 and 1.152.0 along with loggregator-agent v7+ may override other users syslog drain credentials if they're aware of the client certificate used for that syslog drain. This applies even if the drain has zero certs. This would allow the user to override the private key and add or modify a certificate authority used for the connection.
Improper Certificate Validation
Starting with diego-release 2.55.0 and up to 2.69.0, and starting with CF Deployment 17.1 and up to 23.2.0, apps are accessible via another port on diego cells
CVE-2022-31733
9.1 - Critical
- February 03, 2023
Starting with diego-release 2.55.0 and up to 2.69.0, and starting with CF Deployment 17.1 and up to 23.2.0, apps are accessible via another port on diego cells, allowing application ingress without a client certificate. If mTLS route integrity is enabled AND unproxied ports are turned off, then an attacker could connect to an application that should be only reachable via mTLS, without presenting a client certificate.
Improper Certificate Validation
In cloud foundry CAPI versions prior to 1.122, a denial-of-service attack in which a developer can push a service broker
CVE-2021-22100
5.3 - Medium
- March 25, 2022
In cloud foundry CAPI versions prior to 1.122, a denial-of-service attack in which a developer can push a service broker that (accidentally or maliciously) causes CC instances to timeout and fail is possible. An attacker can leverage this vulnerability to cause an inability for anyone to push or manage apps.
Resource Exhaustion
Cloud Controller versions prior to 1.118.0 are vulnerable to unauthenticated denial of Service(DoS) vulnerability
CVE-2021-22101
7.5 - High
- October 27, 2021
Cloud Controller versions prior to 1.118.0 are vulnerable to unauthenticated denial of Service(DoS) vulnerability allowing unauthenticated attackers to cause denial of service by using REST HTTP requests with label_selectors on multiple V3 endpoints by generating an enormous SQL query.
Resource Exhaustion
UAA server versions prior to 75.4.0 are vulnerable to an open redirect vulnerability
CVE-2021-22098
6.1 - Medium
- August 11, 2021
UAA server versions prior to 75.4.0 are vulnerable to an open redirect vulnerability. A malicious user can exploit the open redirect vulnerability by social engineering leading to take over of victims accounts in certain cases along with redirection of UAA users to a malicious sites.
Open Redirect
In UAA versions prior to 75.3.0
CVE-2021-22001
7.5 - High
- July 22, 2021
In UAA versions prior to 75.3.0, sensitive information like relaying secret of the provider was revealed in response when deletion request of an identity provider( IdP) of type oauth 1.0 was sent to UAA server.
Cloud Controller API versions prior to 1.106.0 logs service broker credentials if the default value of db logging config field is changed
CVE-2021-22115
6.5 - Medium
- April 08, 2021
Cloud Controller API versions prior to 1.106.0 logs service broker credentials if the default value of db logging config field is changed. CAPI database logs service broker password in plain text whenever a job to clean up orphaned items is run by Cloud Controller.
Insufficiently Protected Credentials
CAPI (Cloud Controller) versions prior to 1.101.0 are vulnerable to a denial-of-service attack in
CVE-2020-5423
7.5 - High
- December 02, 2020
CAPI (Cloud Controller) versions prior to 1.101.0 are vulnerable to a denial-of-service attack in which an unauthenticated malicious attacker can send specially-crafted YAML files to certain endpoints, causing the YAML parser to consume excessive CPU and RAM.
Resource Exhaustion
Cloud Foundry CAPI (Cloud Controller) versions prior to 1.98.0
CVE-2020-5418
4.3 - Medium
- September 03, 2020
Cloud Foundry CAPI (Cloud Controller) versions prior to 1.98.0 allow authenticated users having only the "cloud_controller.read" scope, but no roles in any spaces, to list all droplets in all spaces (whereas they should see none).
AuthZ
Cloud Foundry Routing (Gorouter) versions prior to 0.206.0 allow a malicious developer with "cf push" access to cause denial-of-service to the CF cluster by pushing an app
CVE-2020-5420
7.7 - High
- September 03, 2020
Cloud Foundry Routing (Gorouter) versions prior to 0.206.0 allow a malicious developer with "cf push" access to cause denial-of-service to the CF cluster by pushing an app that returns specially crafted HTTP responses that crash the Gorouters.
Improper Check for Unusual or Exceptional Conditions
Cloud Foundry Routing (Gorouter), versions prior to 0.204.0, when used in a deployment with NGINX reverse proxies in front of the Gorouters, is potentially vulnerable to denial-of-service attacks in which an unauthenticated malicious attacker can send specially-crafted HTTP requests
CVE-2020-5416
6.5 - Medium
- August 21, 2020
Cloud Foundry Routing (Gorouter), versions prior to 0.204.0, when used in a deployment with NGINX reverse proxies in front of the Gorouters, is potentially vulnerable to denial-of-service attacks in which an unauthenticated malicious attacker can send specially-crafted HTTP requests that may cause the Gorouters to be dropped from the NGINX backend pool.
Improper Resource Shutdown or Release
Cloud Foundry CAPI (Cloud Controller), versions prior to 1.97.0, when used in a deployment where an app domain is also the system domain (which is true in the default CF Deployment manifest), were vulnerable to developers maliciously or accidentally claiming certain sensitive routes, potentially resulting in the developer's app handling some requests
CVE-2020-5417
8.8 - High
- August 21, 2020
Cloud Foundry CAPI (Cloud Controller), versions prior to 1.97.0, when used in a deployment where an app domain is also the system domain (which is true in the default CF Deployment manifest), were vulnerable to developers maliciously or accidentally claiming certain sensitive routes, potentially resulting in the developer's app handling some requests that were expected to go to certain system components.
Incorrect Permission Assignment for Critical Resource
Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler
CVE-2020-15586
5.9 - Medium
- July 17, 2020
Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time.
Race Condition
Cloud Foundry Cloud Controller (CAPI), versions prior to 1.91.0, logs properties of background jobs when they are run
CVE-2020-5400
6.5 - Medium
- February 27, 2020
Cloud Foundry Cloud Controller (CAPI), versions prior to 1.91.0, logs properties of background jobs when they are run, which may include sensitive information such as credentials if provided to the job. A malicious user with access to those logs may gain unauthorized access to resources protected by such credentials.
Insertion of Sensitive Information into Log File
In Cloud Foundry UAA
CVE-2020-5402
8.8 - High
- February 27, 2020
In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function when authenticating with external identity providers.
Session Riding
Cloud Foundry Cloud Controller API (CAPI), version 1.88.0
CVE-2019-11294
4.3 - Medium
- December 19, 2019
Cloud Foundry Cloud Controller API (CAPI), version 1.88.0, allows space developers to list all global service brokers, including service broker URLs and GUIDs, which should only be accessible to admins.
AuthZ
Cloud Foundry UAA Release
CVE-2019-11293
6.5 - Medium
- December 06, 2019
Cloud Foundry UAA Release, versions prior to v74.10.0, when set to logging level DEBUG, logs client_secret credentials when sent as a query parameter. A remote authenticated malicious user could gain access to user credentials via the uaa.log file if authentication is provided via query parameters.
Insertion of Sensitive Information into Log File
Cloud Foundry UAA Release, versions prior to v74.8.0, logs all query parameters to tomcatâs access file
CVE-2019-11290
7.5 - High
- November 26, 2019
Cloud Foundry UAA Release, versions prior to v74.8.0, logs all query parameters to tomcatâs access file. If the query parameters are used to provide authentication, ie. credentials, then they will be logged as well.
Information Disclosure
Cloud Foundry Routing, all versions before 0.193.0, does not properly validate nonce input
CVE-2019-11289
8.6 - High
- November 19, 2019
Cloud Foundry Routing, all versions before 0.193.0, does not properly validate nonce input. A remote unauthenticated malicious user could forge an HTTP route service request using an invalid nonce that will cause the Gorouter to crash.
Improper Input Validation
Cloud Foundry SMB Volume, versions prior to v2.0.3, accidentally outputs sensitive information to the logs
CVE-2019-11283
8.8 - High
- October 23, 2019
Cloud Foundry SMB Volume, versions prior to v2.0.3, accidentally outputs sensitive information to the logs. A remote user with access to the SMB Volume logs can discover the username and password for volumes that have been recently created, allowing the user to take control of the SMB Volume.
Insertion of Sensitive Information into Log File
Cloud Foundry UAA, versions prior to v74.3.0, contains an endpoint that is vulnerable to SCIM injection attack
CVE-2019-11282
4.3 - Medium
- October 23, 2019
Cloud Foundry UAA, versions prior to v74.3.0, contains an endpoint that is vulnerable to SCIM injection attack. A remote authenticated malicious user with scim.invite scope can craft a request with malicious content which can leak information about users of the UAA.
Injection
Cloud Foundry NFS Volume Service, 1.7.x versions prior to 1.7.11 and 2.x versions prior to 2.3.0, is vulnerable to LDAP injection
CVE-2019-11277
8.1 - High
- September 23, 2019
Cloud Foundry NFS Volume Service, 1.7.x versions prior to 1.7.11 and 2.x versions prior to 2.3.0, is vulnerable to LDAP injection. A remote authenticated malicious space developer can potentially inject LDAP filters via service instance creation, facilitating the malicious space developer to deny service or perform a dictionary attack.
Injection
Cloud Foundry cf-deployment, versions prior to 7.9.0, contain java components
CVE-2019-3801
9.8 - Critical
- April 25, 2019
Cloud Foundry cf-deployment, versions prior to 7.9.0, contain java components that are using an insecure protocol to fetch dependencies when building. A remote unauthenticated malicious attacker could hijack the DNS entry for the dependency, and inject malicious code into the component.
Cleartext Transmission of Sensitive Information
Cloud Foundry Diego, release versions prior to 2.8.0, does not properly sanitize file paths in tar and zip files headers
CVE-2018-1265
7.2 - High
- June 06, 2018
Cloud Foundry Diego, release versions prior to 2.8.0, does not properly sanitize file paths in tar and zip files headers. A remote attacker with CF admin privileges can upload a malicious buildpack that will allow a complete takeover of a Diego Cell VM and access to all apps running on that Diego Cell.
Unrestricted File Upload
Cloud Foundry routing-release, versions prior to 0.175.0, lacks sanitization for user-provided X-Forwarded-Proto headers
CVE-2018-1193
5.3 - Medium
- May 23, 2018
Cloud Foundry routing-release, versions prior to 0.175.0, lacks sanitization for user-provided X-Forwarded-Proto headers. A remote user can set the X-Forwarded-Proto header in a request to potentially bypass an application requirement to only respond over secure connections.
Cloud Foundry Foundation UAA, versions 4.12.X and 4.13.X, introduced a feature which could
CVE-2018-1262
7.2 - High
- May 15, 2018
Cloud Foundry Foundation UAA, versions 4.12.X and 4.13.X, introduced a feature which could allow privilege escalation across identity zones for clients performing offline validation. A zone administrator could configure their zone to issue tokens which impersonate another zone, granting up to admin privileges in the impersonated zone for clients performing offline token validation.
Cloud Foundry Garden-runC, versions prior to 1.13.0, does not correctly enforce disc quotas for Docker image layers
CVE-2018-1277
6.5 - Medium
- April 30, 2018
Cloud Foundry Garden-runC, versions prior to 1.13.0, does not correctly enforce disc quotas for Docker image layers. A remote authenticated user may push an app with a malicious Docker image that will consume more space on a Diego cell than allocated in their quota, potentially causing a DoS against the cell.
Resource Exhaustion
Cloud Foundry Garden-runC, versions prior to 1.11.0, contains an information exposure vulnerability
CVE-2018-1191
8.8 - High
- March 29, 2018
Cloud Foundry Garden-runC, versions prior to 1.11.0, contains an information exposure vulnerability. A user with access to Garden logs may be able to obtain leaked credentials and perform authenticated actions using those credentials.
Information Disclosure
In Cloud Controller versions prior to 1.46.0
CVE-2018-1195
8.8 - High
- March 19, 2018
In Cloud Controller versions prior to 1.46.0, cf-deployment versions prior to 1.3.0, and cf-release versions prior to 283, Cloud Controller accepts refresh tokens for authentication where access tokens are expected. This exposes a vulnerability where a refresh token that would otherwise be insufficient to obtain an access token, either due to lack of client credentials or revocation, would allow authentication.
Insufficient Session Expiration
In cf-deployment before 1.14.0 and routing-release before 0.172.0
CVE-2018-1221
8.1 - High
- March 19, 2018
In cf-deployment before 1.14.0 and routing-release before 0.172.0, the Cloud Foundry Gorouter mishandles WebSocket requests for AWS Application Load Balancers (ALBs) and some other HTTP-aware Load Balancers. A user with developer privileges could use this vulnerability to steal data or cause denial of service.
Improper Input Validation
An issue was discovered in Cloud Foundry Foundation capi-release (all versions prior to 1.45.0)
CVE-2017-14389
6.5 - Medium
- November 28, 2017
An issue was discovered in Cloud Foundry Foundation capi-release (all versions prior to 1.45.0), cf-release (all versions prior to v280), and cf-deployment (all versions prior to v1.0.0). The Cloud Controller does not prevent space developers from creating subdomains to an already existing route that belongs to a different user in a different org and space, aka an "Application Subdomain Takeover."
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Cloudfoundry Cf Release or by Cloudfoundry? Click the Watch button to subscribe.
