CVE-2017-8032 Cloud Foundry UAA Identity Zone Admin Privilege Escalation

What is CVE-2017-8032?

CVE-2017-8032 is a medium-severity vulnerability in Cloud Foundry, published on 10 Jul 2017. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

In Cloud Foundry cf-release versions prior to v264; UAA release all versions of UAA v2.x.x, 3.6.x versions prior to v3.6.13, 3.9.x versions prior to v3.9.15, 3.20.x versions prior to v3.20.0, and other versions prior to v4.4.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.17, 24.x versions prior to v24.12. 30.x versions prior to 30.5, and other versions prior to v41, zone administrators are allowed to escalate their privileges when mapping permissions for an external provider.

Weakness: CWE-269

Which versions are affected by CVE-2017-8032?

8 open source packages ship an affected version, including org.cloudfoundry.identity:cloudfoundry-identity-server. It affects 3 products.

Products include Cloudfoundry Cloud Foundry Uaa Bosh, Pivotal Software Cloud Foundry Cf, Pivotal Software Cloud Foundry Uaa.

How do I fix CVE-2017-8032?

Upgrade org.cloudfoundry.identity:cloudfoundry-identity-server to a fixed version for your release line: 3.6.13, 3.20.0, 3.9.15 or 4.4.0.

Is CVE-2017-8032 being exploited?

There is no known exploitation of CVE-2017-8032 in the wild and no public exploit code.

Other vulnerabilities in Cloud Foundry

• CVE-2016-6637 Cloud Foundry vulnerable to Cross-Site Request Forgery Critical 9.6
• CVE-2017-4973 Cloud Foundry UAA Privilege Escalation High 8.8
• CVE-2016-4468 SQL injection in n/a High 8.8
• CVE-2016-6651 Privilege escalation in n/a High 8.8
• CVE-2016-3084 Cloud Foundry UAA reset password vulnerable to brute force attack High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-9frw-wmvq-5rrc.