Cloud Foundry Staticfile.auth 7pk security

Summaryinfo

A vulnerability described as critical has been identified in Cloud Foundry. Affected by this issue is some unknown functionality of the file Staticfile.auth. Executing a manipulation can lead to 7pk security. This vulnerability appears as CVE-2017-4970. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability classified as critical was found in Cloud Foundry (Cloud Software) (unknown version). This vulnerability affects an unknown code block of the file Staticfile.auth. The manipulation with an unknown input leads to a 7pk security vulnerability. The CWE definition for the vulnerability is CWE-254. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

An issue was discovered in Cloud Foundry Foundation cf-release v255 and Staticfile buildpack versions v1.4.0 - v1.4.3. A regression introduced in the Static file build pack causes the Staticfile.auth configuration to be ignored when the Static file file is not present in the application root. Applications containing a Staticfile.auth file but not a Static file had their basic auth turned off when an operator upgraded the Static file build pack in the foundation to one of the vulnerable versions. Note that Static file applications without a Static file are technically misconfigured, and will not successfully detect unless the Static file build pack is explicitly specified.

The bug was discovered 04/10/2017. The weakness was presented 06/13/2017 (Website). The advisory is shared for download at cloudfoundry.org. This vulnerability was named CVE-2017-4970 since 12/29/2016. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1211.

The vulnerability was handled as a non-public zero-day exploit for at least 64 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

See VDB-102272, VDB-102271, VDB-102270 and VDB-102264 for similar entries. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Cloud Software

Name

• Cloud Foundry

License

• free

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion