Cloud Foundry vulnerabilities

A SpaceSupporter could improperly modify an application's start command and buildpack—actions requiring SpaceDeveloper privileges. This privilege escalation enables unauthorized retrieval of service credentials through malicious start commands or custom buildpacks.

A user with SpaceDeveloper privileges could modify the URL of a space-scoped broker without altering its credentials, enabling extraction of existing broker credentials by redirecting them to a broker under their control. The CF API does not permit direct reading of broker credentials, making this an indirect extraction method.

An authentication bypass vulnerability in cf-auth-proxy in Cloud Foundry Foundation allows an unauthenticated remote attacker to read all logs and metrics for every application and platform component by minting a JWT accepted as a valid logs.admin token.