Description (CNA)
setupBpmLogs follows symlink for bpm.log open and chown — container-to-host privilege escalation via /etc/shadow. A compromised process inside a bpm container can cause root to chown an arbitrary host file to vcap and append bpm JSON log lines to it. The chown alone lets the attacker take ownership of /etc/shadow and read every password hash on the host via the read-only /etc bind mount. This is a container-to-host confidentiality break affecting every bpm-managed job. Affected versions: bpm-release, all versions prior to v1.4.30.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Cloud Foundry Foundation / bpm-release | affected 0 before 1.4.30 |
CWE
CWE-59
References
ADP enrichment
No English description supplied.
No references supplied.