BOSH CLI vulnerabilities

A path key traversal vulnerability in the BOSH CLI tool allows an attacker to write arbitrary files and exfiltrate sensitive information via the blobs.yml file. Affected versions are prior to v7.10.4.

Command Injection in BOSH CLI tool on Windows in Cloud Foundry allows a remote attacker to execute arbitrary shell commands via command injection vulnerabilities.

An argument injection vulnerability in bosh-cli allows a compromised BOSH Director to inject arbitrary OpenSSH options into the locally-spawned SSH process when an operator runs bosh ssh -c, bosh logs -f, or other non-interactive SSH paths, leading to local command execution on the operator's workstation.

A vulnerability in BOSH CLI (versions prior to 7.10.4) causes the client to skip server certificate verification for DAV blobstore during create-env and delete-env operations, allowing a network attacker to intercept Basic-auth credentials and read the rendered-templates archive containing all bootstrap secrets for the new BOSH Director.

A compromised or malicious BOSH Director can execute arbitrary shell commands on the operator's workstation when the operator runs bosh ssh (or bosh scp/bosh logs -f) with default flags. Affected versions: BOSH CLI prior to 7.10.5.