CVE-2018-1264 Log Cache logs UAA client secret on startup
An attacker with VM access can read the UAA client secret from startup logs, potentially gaining admin privileges over the Cloud Foundry foundation.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-1264?
CVE-2018-1264 is a critical vulnerability in Cloud Foundry log-cache-release, published on 5 Oct 2018. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Cloud Foundry Log Cache, versions prior to 1.1.1, logs its UAA client secret on startup as part of its envstruct report. A remote attacker who has gained access to the Log Cache VM can read this secret, gaining all privileges held by the Log Cache UAA client. In the worst case, if this client is an admin, the attacker would gain complete control over the Foundation.
Weakness: CWE-532
Which versions are affected by CVE-2018-1264?
It affects 1 product.
Products include Pivotal Software Cloud Foundry Log Cache.
How do I fix CVE-2018-1264?
No fix has been published for CVE-2018-1264 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-1264 being exploited?
There is no known exploitation of CVE-2018-1264 in the wild and no public exploit code.
Sources
Also known as GHSA-829v-ph86-cw55.