CVE-2019-11289 A forged route service request using an invalid nonce can cause the gorouter to panic and crash

What is CVE-2019-11289?

CVE-2019-11289 is a high-severity denial of service vulnerability in Cloud Foundry Routing, published on 19 Nov 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Cloud Foundry Routing, all versions before 0.193.0, does not properly validate nonce input. A remote unauthenticated malicious user could forge an HTTP route service request using an invalid nonce that will cause the Gorouter to crash.

Weakness: CWE-20

Which versions are affected by CVE-2019-11289?

4 open source packages ship an affected version, including code.cloudfoundry.org/gorouter and github.com/cloudfoundry/gorouter. It affects 2 products.

Products include Cloudfoundry Cf-Deployment, Cloudfoundry Routing-Release.

How do I fix CVE-2019-11289?

Upgrade code.cloudfoundry.org/gorouter to 0.0.0-20191101214924-b1b5c44e050f or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2019-11289 being exploited?

There is no known exploitation of CVE-2019-11289 in the wild and no public exploit code.

Other vulnerabilities in Cloud Foundry Routing

• CVE-2022-31733 Auth bypass in Cloud Foundry Diego and CF Deployment Critical 9.1
• CVE-2020-5402 UAA fails to check the state parameter when authenticating with external IDPs High 8.8
• CVE-2019-11293 UAA logs all query parameters with debug logging level High 8.8
• CVE-2019-11290 Cloud Foundry UAA logs query parameters in tomcat access file High 8.8
• CVE-2019-11283 Password leak in smbdriver logs High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5796-p3m6-9qj4, GO-2021-0102.