CVE-2019-11289: Cloud Foundry Routing Improper Input Validation vulnerability
Summary
CVE-2019-11289: Cloud Foundry Routing Improper Input Validation vulnerability. Affects code.cloudfoundry.org/gorouter versions < 0.0.0-20191101214924-b1b5c44e050f. Fixed in 0.0.0-20191101214924-b1b5c44e050f. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cloud Foundry Routing is a component of the Cloud Foundry platform that handles routing requests to applications deployed on the platform. It is written in Go and is responsible for load balancing and routing traffic to the appropriate application instances. This vulnerability affects all versions of Cloud Foundry Routing before 0.0.0-20191101214924-b1b5c44e050f. The vulnerability arises from improper input validation of nonces in route service requests. An unauthorized remote attacker can exploit this vulnerability by forging a route service request with an invalid nonce, leading to a crash of the Gorouter component.
Vulnerability Detail
The Cloud Foundry Routing vulnerability allows an attacker to crash the Gorouter component by sending a route service request with an invalid nonce. The Gorouter does not properly validate the nonce input, allowing an unauthorized remote attacker to exploit this vulnerability. The impact of this vulnerability is a denial of service, as the Gorouter crashes and becomes unavailable. This can disrupt the routing of traffic to applications deployed on the Cloud Foundry platform.
How To Fix
Minimum fixed version
0.0.0-20191101214924-b1b5c44e050f
This is the first release that contains the fix.
go get code.cloudfoundry.org/gorouter@v0.0.0-20191101214924-b1b5c44e050fTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of Cloud Foundry Routing as soon as possible.
Conclusion
The Cloud Foundry Routing vulnerability (CVE-2019-11289) allows an unauthorized remote attacker to crash the Gorouter component by sending a route service request with an invalid nonce. To mitigate this vulnerability, it is crucial to upgrade to version 0.0.0-20191101214924-b1b5c44e050f or later of Cloud Foundry Routing. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for code.cloudfoundry.org/gorouter →
FAQ
Cloud Foundry Routing is a component of the Cloud Foundry platform that handles routing requests to applications deployed on the platform. It is responsible for load balancing and routing traffic to the appropriate application instances.
The impact of this vulnerability is a denial of service, as the Gorouter component crashes and becomes unavailable. This can disrupt the routing of traffic to applications deployed on the Cloud Foundry platform.
An attacker can exploit this vulnerability by forging a route service request with an invalid nonce. The Gorouter does not properly validate the nonce input, allowing the attacker to crash the Gorouter.
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of Cloud Foundry Routing.
The CVSS score of this vulnerability is 7.5, indicating a high severity.
