A path traversal vulnerability in the CloudFoundry BOSH CLI tool could allow an unauthenticated attacker to perform unauthorized file writes, potentially leading to system compromise.

This vulnerability is a path traversal flaw (CWE-22) triggered during the processing of blobs.yaml files. An attacker can manipulate file paths to write files outside of the intended directory, which does not require authentication to exploit.

Successful exploitation allows an attacker to write arbitrary files to the host system, which could lead to full system compromise or the injection of malicious code into the deployment pipeline. With a CVSS score of 8.5, this high-severity vulnerability poses a significant risk to the integrity and availability of CI/CD environments relying on the BOSH CLI.

Immediate Action: Upgrade the CloudFoundry BOSH CLI tool to version 7.10.4 or later immediately.

Proactive Monitoring: Monitor build logs and filesystem integrity in environments where the BOSH CLI is utilized to detect unauthorized file write attempts.

Compensating Controls: Restrict access to the BOSH CLI environment and ensure that it is executed within a hardened, isolated container or virtual machine with minimal file system permissions.

Public Exploit Available: false

Given the potential for unauthorized file system modification, organizations should prioritize upgrading their BOSH CLI installations. Failure to patch this vulnerability could expose critical infrastructure to severe manipulation.