PackagePersister.validatetgz builds "tar -tf #{tgz} 2>&1" where tgz = File.join(releasedir, 'packages', "#{name}.tgz") and name = packagemeta['name'] comes directly from release.MF inside the uploaded tarball. The string is passed to Bosh::Common::Exec.sh, which executes via %x{} — i.e., /bin/sh -c. No Shellwords.escape is applied. The Models::Package Sequel validation (VALIDID = /^[-0-9A-Za-z+.]+$/i) would reject the name, but in createpackage (lines 74–79) the shell-out in savepackagesourceblob runs before package.save, so validation fires too late.
Affected versions: - BOSH: all versions prior to v282.1.12 (inclusive); fixed in v282.1.12 or later
A network man-in-the-middle between nats-sync and the BOSH director can steal the director credentials (Basic auth header or UAA client secret) and can tamper with the VM list that is written into the NATS authorization file. Stolen credentials grant administrative director access. UsersSync#boshapiresponsebody builds a Net::HTTP client with verifymode = OpenSSL::SSL::VERIFYNONE for every director call (/info, /deployments, /deployments/<name>/vms).
Affected versions: - BOSH: all versions prior to v282.1.9 (inclusive); fixed in v282.1.9 or later
CWE-326 in BOSH allows a local attacker to steal Basic-auth credentials or redirect UAA token requests via MITM. HttpRequestHelper#createasyncendpoint and #sendhttpgetrequestsynchronous hard-code OpenSSL::SSL::VERIFYNONE, enabling an attacker to intercept traffic between bosh-monitor and the BOSH director or UAA and steal credentials.
Affected versions: - BOSH: all versions prior to v282.1.9 (inclusive); fixed in v282.1.9 or later
AgentClient#handlemethod (lines 264-303) processes every NATS reply. It calls injectcompilelog (line 273) on every response, which reads response['value']['result']['compilelogid'] (line 332-338) and passes it to downloadanddeleteblob. Separately, any response containing 'exception' goes through formatexception (lines 308-325), which reads exception['blobstoreid'] and also calls downloadanddeleteblob. That helper (lines 344-349) calls ResourceManager#getresource(blobid) and, in an ensure block, ResourceManager#deleteresource(blobid). ResourceManager (resourcemanager.rb:62-70) calls blobstore.delete(id) on the single shared Director blobstore with no UUID-format check, no ownership check, and no namespace prefix.
Affected versions: BOSH Director: All versions prior to v282.1.12
When the director sends a long-running request (e.g. compilepackage), the agent's reply JSON is consumed by AgentClient. injectcompilelog (line 332-339) reads response['value']['result']['compilelogid'] and formatexception (line 318-325) reads exception['blobstoreid']; both pass the agent-supplied string unmodified to downloadanddeleteblob(blobid) (line 344-349), which calls @resourcemanager.getresource(blobid) and, in an ensure block, @resourcemanager.deleteresource(blobid). Api::ResourceManager forwards the id straight to blobstore.get(id) / blobstore.delete(id). When the director is configured with the local blobstore provider, Blobstore::LocalClient#objectfilepath(oid) is File.join(@blobstorepath, oid) (localclient.rb:54-56) with no normalisation, so oid = "../../jobs/director/config/director.yml" resolves outside the blobstore root.
Affected versions: BOSH Director: All versions prior to v282.1.12