CVE-2023-20881 Missing authorization in Cloud Controller API
Attackers can override other users' syslog drain credentials by exploiting missing authorization checks in Cloud Foundry CAPI.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-20881?
CVE-2023-20881 is a high-severity missing authorization vulnerability in Cloud Controller API, published on 19 May 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Cloud foundry instances having CAPI version between 1.140 and 1.152.0 along with loggregator-agent v7+ may override other users syslog drain credentials if they're aware of the client certificate used for that syslog drain. This applies even if the drain has zero certs. This would allow the user to override the private key and add or modify a certificate authority used for the connection.
Weakness: CWE-295
Which versions are affected by CVE-2023-20881?
It affects 3 products.
Products include Cloudfoundry Capi-Release, Cloudfoundry Cf-Deployment, Cloudfoundry Loggregator-Agent.
How do I fix CVE-2023-20881?
No fix has been published for CVE-2023-20881 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-20881 being exploited?
There is no known exploitation of CVE-2023-20881 in the wild and no public exploit code.
Other vulnerabilities in Cloud Controller API
- CVE-2018-1195 Auth bypass in Cloud Controller
- CVE-2020-5417 Cloud Controller may allow developers to claim sensitive routes
- CVE-2018-1266 Path traversal in n/a
- CVE-2020-5400 Cloud Controller logs environment variables from app manifests
- CVE-2017-8033 Path traversal in Cloud Controller API CAPI-release versions prior to v1.35.0 and cf-release versions prior to v268
Sources
Also known as GHSA-gwjh-7ghx-8gww.