Cloud Foundry Route Services Firewall Bypass Vulnerability

A vulnerability exists in Cloud Foundry's Route Services feature, allowing app traffic to bypass configured egress rules and reach internal network destinations. This could enable a malicious developer to send requests to HTTP services on internal networks accessible by the Gorouter, potentially exposing services that were not previously reachable from external networks or the application itself. The vulnerability affects Cloud Foundry Routing Release versions 0.118.0 through 0.371.0, and Cloud Foundry Deployment versions 0.0.2 through 54.14.0.

Impact

Exploitation of this vulnerability could lead to unauthorized access to internal network services, bypassing application egress controls.

Remediation

Users are advised to upgrade to Cloud Foundry Routing Release version 0.372.0 or greater, and to upgrade Cloud Foundry Deployment to version 55.0.0 or greater, both of which include the patched routing release.