CVE-2024-37082

Summary

When deploying Cloud Foundry together with the haproxy-boshrelease and using a non default configuration, it might be possible to craft HTTP requests that bypass mTLS authentication to Cloud Foundry applications. 

You are affected if you have route-services enabled in routing-release and have configured the haproxy-boshrelease property “ha_proxy.forwarded_client_cert” to “forward_only_if_route_service”.

Affected Software

Weaknesses

• CWE-290: CWE-290 Authentication Bypass by Spoofing

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: total

CVE Program Container

Additional References

• https://www.cloudfoundry.org/blog/cve-2024-37082-mtls-bypass/

References

• https://www.cloudfoundry.org/blog/cve-2024-37082-mtls-bypass/

• ←Previous
• Next→