CVE-2018-1262 UAA privilege escalation across identity zones

What is CVE-2018-1262?

CVE-2018-1262 is a high-severity vulnerability in CloudFoundry UAA, published on 15 May 2018. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Cloud Foundry Foundation UAA, versions 4.12.X and 4.13.X, introduced a feature which could allow privilege escalation across identity zones for clients performing offline validation. A zone administrator could configure their zone to issue tokens which impersonate another zone, granting up to admin privileges in the impersonated zone for clients performing offline token validation.

Which versions are affected by CVE-2018-1262?

4 open source packages ship an affected version, including org.cloudfoundry.identity:cloudfoundry-identity-server. It affects 3 products.

Products include Cloudfoundry Cf-Deployment, Pivotal Software Cloud Foundry Uaa, Pivotal Software Cloud Foundry Uaa-Release.

How do I fix CVE-2018-1262?

Upgrade org.cloudfoundry.identity:cloudfoundry-identity-server to a fixed version for your release line: 4.12.2 or 4.13.4.

Is CVE-2018-1262 being exploited?

There is no known exploitation of CVE-2018-1262 in the wild and no public exploit code.

Other vulnerabilities in CloudFoundry UAA

• CVE-2022-31733 Auth bypass in Cloud Foundry Diego and CF Deployment Critical 9.1
• CVE-2020-5402 UAA fails to check the state parameter when authenticating with external IDPs High 8.8
• CVE-2019-11293 UAA logs all query parameters with debug logging level High 8.8
• CVE-2019-11290 Cloud Foundry UAA logs query parameters in tomcat access file High 8.8
• CVE-2019-11283 Password leak in smbdriver logs High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8v97-gv3g-32rf.