CVE-2018-11047 Cloud Foundry UAA accepts refresh token as access token on admin endpoints

What is CVE-2018-11047?

CVE-2018-11047 is a high-severity authentication bypass vulnerability in Cloud Foundry UAA, published on 24 Jul 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Cloud Foundry UAA, versions 4.19 prior to 4.19.2 and 4.12 prior to 4.12.4 and 4.10 prior to 4.10.2 and 4.7 prior to 4.7.6 and 4.5 prior to 4.5.7, incorrectly authorizes requests to admin endpoints by accepting a valid refresh token in lieu of an access token. Refresh tokens by design have a longer expiration time than access tokens, allowing the possessor of a refresh token to authenticate longer than expected. This affects the administrative endpoints of the UAA. i.e. /Users, /Groups, etc. However, if the user has been deleted or had groups removed, or the client was deleted, the refresh token will no longer be valid.

Weakness: CWE-863

Which versions are affected by CVE-2018-11047?

10 open source packages ship an affected version, including org.cloudfoundry.identity:cloudfoundry-identity-server. It affects 1 product.

Products include Pivotal Software Cloud Foundry Uaa.

How do I fix CVE-2018-11047?

Upgrade org.cloudfoundry.identity:cloudfoundry-identity-server to a fixed version for your release line: 4.5.7, 4.12.4, 4.19.2 or 4.7.6.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2018-11047 being exploited?

There is no known exploitation of CVE-2018-11047 in the wild and no public exploit code.

Other vulnerabilities in Cloud Foundry UAA

• CVE-2018-15761 UAA Privilege Escalation Critical 9.9
• CVE-2019-3794 UAA - Login app subject to clickjacking attack Medium 6.5
• CVE-2018-11041 Cloud Foundry UAA open redirect Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-r4v8-9hgx-vm6m.