Cloud Foundry BOSH CLI Shell Injection Vulnerability

A shell injection vulnerability has been identified in Cloud Foundry BOSH CLI versions prior to 7.10.5. This vulnerability allows a compromised or malicious BOSH Director to execute arbitrary shell commands on the operator's workstation. The issue arises when the operator uses the 'bosh ssh', 'bosh scp', or 'bosh logs -f' commands with default flags.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of shell commands on the operator's workstation, potentially allowing for further manipulation or compromise of the system.

Remediation

Users are advised to upgrade BOSH CLI to version 7.10.5 or later.