Capi Cloud Controller Api
Monthly
Broken access control in the Cloud Foundry Cloud Controller API leaves the /internal/v3/staging/:guid/droplet_completed and /internal/v3/staging/:guid/build_completed callback endpoints reachable on the public API listener, because the shipped Nginx routing configuration carries deny rules for /internal/v4/ and /internal/v5/ but omits the equivalent rule for /internal/v3/. An attacker who holds a valid build or droplet GUID - and a SpaceAuditor can enumerate those GUIDs without any write permission - can post a forged staging callback, transition a droplet to STAGED, and persist arbitrary process and sidecar metadata with no associated package or actor, escalating past the intended role boundary. No public exploit code was identified at time of analysis, and the vendor has published fixed versions; triage guidance places remediation in this week's work rather than an emergency response.
Broken access control in the Cloud Foundry Cloud Controller API leaves the /internal/v3/staging/:guid/droplet_completed and /internal/v3/staging/:guid/build_completed callback endpoints reachable on the public API listener, because the shipped Nginx routing configuration carries deny rules for /internal/v4/ and /internal/v5/ but omits the equivalent rule for /internal/v3/. An attacker who holds a valid build or droplet GUID - and a SpaceAuditor can enumerate those GUIDs without any write permission - can post a forged staging callback, transition a droplet to STAGED, and persist arbitrary process and sidecar metadata with no associated package or actor, escalating past the intended role boundary. No public exploit code was identified at time of analysis, and the vendor has published fixed versions; triage guidance places remediation in this week's work rather than an emergency response.