CVE-2018-1265

Vulnerability

Cloud Foundry Diego, release versions prior to 2.8.0, does not properly sanitize file paths in tar and zip file headers. This vulnerability allows a remote attacker with CF admin privileges to upload a malicious buildpack that exploits the path traversal. Affected versions include diego-release prior to 2.8.0 and cf-deployment prior to v1.37.0 [1].

Exploitation

An attacker must have Cloud Foundry admin privileges to upload a malicious buildpack. The buildpack contains tar or zip files with crafted file paths that bypass sanitization. Upon processing, the paths allow writing files to arbitrary locations on the Diego Cell VM [1].

Impact

Successful exploitation results in complete takeover of the Diego Cell VM. The attacker gains access to all applications running on that Diego Cell, leading to full compromise of confidentiality, integrity, and availability of those apps [1].

Mitigation

Users should upgrade to diego-release version 2.8.0 or cf-deployment version v1.37.0, which contain the fix. No workarounds are mentioned in the available references [1].