CVE-2017-4972 SQL injection in Cloud Foundry UAA

What is CVE-2017-4972?

CVE-2017-4972 is a high-severity SQL injection vulnerability in Cloud Foundry UAA, published on 13 Jun 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v257; UAA release 2.x versions prior to v2.7.4.14, 3.6.x versions prior to v3.6.8, 3.9.x versions prior to v3.9.10, and other versions prior to v3.15.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.12, 24.x versions prior to v24.7, and other versions prior to v30. An attacker can use a blind SQL injection attack to query the contents of the UAA database.

Weakness: CWE-89

Which versions are affected by CVE-2017-4972?

It affects 3 products.

Products include Cloudfoundry Cf-Release, Cloudfoundry Cloud Foundry Uaa Bosh, Pivotal Software Cloud Foundry Uaa.

How do I fix CVE-2017-4972?

No fix has been published for CVE-2017-4972 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2017-4972 being exploited?

There is no known exploitation of CVE-2017-4972 in the wild and no public exploit code.

Other vulnerabilities in Cloud Foundry UAA

• CVE-2015-5171 Cloud Foundry Runtime Insufficient Session Expiration vulnerability Critical 9.8
• CVE-2015-5172 Cloud Foundry Runtime has Weak Password Recovery Mechanism for Forgotten Password Critical 9.8
• CVE-2016-8218 Auth bypass in Cloud Foundry Critical 9.8
• CVE-2017-4992 Cloud Foundry UAA privilege escalation with user invitations Critical 9.8
• CVE-2016-6658 Information disclosure in n/a Critical 9.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5w93-xgv6-rpgw.