Cloud Foundry UAA up to 4.19.1 Admin Endpoint Request improper authorization

Summaryinfo

A vulnerability was found in Cloud Foundry UAA up to 4.5.6/4.7.5/4.10.1/4.12.3/4.19.1. It has been classified as critical. Affected by this vulnerability is an unknown functionality of the component Admin Endpoint. This manipulation as part of Request causes improper authorization. This vulnerability is registered as CVE-2018-11047. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Cloud Foundry UAA up to 4.5.6/4.7.5/4.10.1/4.12.3/4.19.1 (Cloud Software). It has been declared as critical. Affected by this vulnerability is an unknown code block of the component Admin Endpoint. The manipulation as part of a Request leads to a improper authorization vulnerability. The CWE definition for the vulnerability is CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Cloud Foundry UAA, versions 4.19 prior to 4.19.2 and 4.12 prior to 4.12.4 and 4.10 prior to 4.10.2 and 4.7 prior to 4.7.6 and 4.5 prior to 4.5.7, incorrectly authorizes requests to admin endpoints by accepting a valid refresh token in lieu of an access token. Refresh tokens by design have a longer expiration time than access tokens, allowing the possessor of a refresh token to authenticate longer than expected. This affects the administrative endpoints of the UAA. i.e. /Users, /Groups, etc. However, if the user has been deleted or had groups removed, or the client was deleted, the refresh token will no longer be valid.

The bug was discovered 07/18/2018. The weakness was published 07/24/2018 (Website). It is possible to read the advisory at cloudfoundry.org. This vulnerability is known as CVE-2018-11047 since 05/14/2018. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1548.002 according to MITRE ATT&CK.

The vulnerability was handled as a non-public zero-day exploit for at least 6 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 4.5.7, 4.7.6, 4.10.2, 4.12.4 or 4.19.2 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Cloud Software

Name

• Cloud Foundry UAA

Version

• 4.5.0
• 4.5.1
• 4.5.2
• 4.5.3
• 4.5.4
• 4.5.5
• 4.5.6
• 4.7.0
• 4.7.1
• 4.7.2
• 4.7.3
• 4.7.4
• 4.7.5
• 4.10.0
• 4.10.1
• 4.12.0
• 4.12.1
• 4.12.2
• 4.12.3
• 4.19.0
• 4.19.1

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion