Cloud Foundry UAA LDAP StartTLS Impersonation Vulnerability Allowing Password Harvesting and Admin Scope Granting

A vulnerability exists in Cloud Foundry UAA versions prior to v78.13.0 and in cf-deployment versions prior to v56.2.0. This vulnerability allows a network attacker positioned between UAA and its LDAP directory to impersonate the directory using any certificate from a trusted CA. The attacker can then harvest the LDAP bind password and all end-user passwords transmitted during simple-bind authentication. Additionally, the attacker can return forged group memberships that grant admin scopes. This issue affects deployments that authenticate users against LDAP over StartTLS.

Impact

Exploitation of this vulnerability allows for impersonation of the LDAP directory, interception of LDAP bind passwords and end-user passwords during simple-bind authentication, and unauthorized elevation of privileges through forged group memberships that grant admin rights.

Remediation

Users are advised to upgrade UAA to version 78.13.0 or greater and to upgrade cf-deployment to version 56.1.0 or greater.