CVE-2018-1195: Cloud Controller API will accept a refresh token for authentication

Severity

High

Vendor

Cloud Foundry Foundation

Affected Cloud Foundry Products and Versions

• You are using Cloud Controller version prior to 1.46.0
• You are using cf-deployment version prior to 1.3.0
• You are using cf-release version prior to 283

Description

Cloud Controller accepts refresh tokens for authentication where access tokens are expected. This exposes a vulnerability where a refresh token that would otherwise be insufficient to obtain an access token, either due to lack of client credentials or revocation, would allow authentication.

Mitigation

Users of affected versions should apply the following mitigations or upgrades:

• Releases that have fixed this issue include:
  • Cloud Controller 1.46.0
  • cf-deployment 1.3.0
  • cf-release 283

Credit

This issue was responsibly reported by SAP.

History

2018-03-05: Initial vulnerability report published.