CVE-2016-8218 Auth bypass in Cloud Foundry
Attackers can impersonate users to the routing API due to incomplete JWT validation, requiring an upgrade to secure the Cloud Foundry environment.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-8218?
CVE-2016-8218 is a critical authentication bypass vulnerability in Cloud Foundry, published on 13 Jun 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Cloud Foundry Foundation routing-release versions prior to 0.142.0 and cf-release versions 203 to 231. Incomplete validation logic in JSON Web Token (JWT) libraries can allow unprivileged attackers to impersonate other users to the routing API, aka an "Unauthenticated JWT signing algorithm in routing" issue.
Weakness: CWE-20
Which versions are affected by CVE-2016-8218?
It affects 2 products.
Products include Cloudfoundry Cf-Release, Cloudfoundry Routing-Release.
How do I fix CVE-2016-8218?
No fix has been published for CVE-2016-8218 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2016-8218 being exploited?
There is no known exploitation of CVE-2016-8218 in the wild and no public exploit code.
Other vulnerabilities in Cloud Foundry
- CVE-2015-5171 Cloud Foundry Runtime Insufficient Session Expiration vulnerability
- CVE-2015-5172 Cloud Foundry Runtime has Weak Password Recovery Mechanism for Forgotten Password
- CVE-2017-4992 Cloud Foundry UAA privilege escalation with user invitations
- CVE-2016-6658 Information disclosure in n/a
- CVE-2015-5170 Cloud Foundry Runtime Cross-Site Request Forgery vulnerability
Sources
Also known as GHSA-vc7q-m69g-gmvq.