BOSH CLI Missing TLS Certificate Verification Vulnerability Allows Root Code Execution via Man-in-the-Middle Credential Replay

A vulnerability exists in BOSH CLI versions prior to v7.10.4, where the CLI fails to verify the server certificate during HTTPS uploads of compiled CPI packages and rendered job templates to the VM's DAV blobstore. This issue occurs despite a CA certificate being available in the installation manifest. A network attacker could exploit this by terminating the TLS connection, capturing Basic-auth credentials, and accessing the rendered-templates archive, which contains all bootstrap secrets for the new BOSH Director. The attacker could then replay these credentials against the VM's agent to execute root code.

Impact

Exploitation of this vulnerability allows for unauthorized root code execution on the affected VM.

Remediation

Users are advised to upgrade BOSH CLI to version 7.10.4 or later.