Cloud Foundry Cloud Controller API CVE-2017-8033 Directory Traversal Vulnerability

Bugtraq ID:	99996
Class:	Input Validation Error
CVE:	CVE-2017-8033
Remote:	Yes
Local:	No
Published:	Jul 19 2017 12:00AM
Updated:	Jul 19 2017 12:00AM
Credit:	GE Digital Security Team.
Vulnerable:	Cloud Foundry cf-release 90 Cloud Foundry cf-release 80 Cloud Foundry cf-release 70 Cloud Foundry cf-release 68 Cloud Foundry cf-release 267 Cloud Foundry cf-release 260 Cloud Foundry cf-release 250 Cloud Foundry cf-release 240 Cloud Foundry cf-release 230 Cloud Foundry cf-release 220 Cloud Foundry cf-release 210 Cloud Foundry cf-release 200 Cloud Foundry cf-release 100 Cloud Foundry capi-release 1.34 Cloud Foundry capi-release 1.30 Cloud Foundry capi-release 1.20 Cloud Foundry capi-release 1.12 Cloud Foundry capi-release 1.10 Cloud Foundry capi-release 1.0
Not Vulnerable:	Cloud Foundry cf-release 268 Cloud Foundry capi-release 1.35

Cloud Foundry Cloud Controller API CVE-2017-8033 Directory Traversal Vulnerability

Cloud Foundry Cloud Controller API is prone to a directory-traversal vulnerability.

Remote attackers can use specially crafted requests with directory-traversal sequences ('../') to write arbitrary files in the context of the affected virtual machine. This may aid in further attacks.

CAPI-release prior to 1.35.0 and cf-release prior to v268 are vulnerable.

Cloud Foundry Cloud Controller API CVE-2017-8033 Directory Traversal Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Cloud Foundry Cloud Controller API CVE-2017-8033 Directory Traversal Vulnerability

References:

• Cloud Foundry capi-release (Cloud Foundry)
  
• cloudfoundry/cf-release (Cloud Foundry)
  
• CVE-2017-8033: Cloud Controller API filesystem traversal vulnerability (Cloud Foundry)