Executive brief
BOSH Director, a tool used for deploying and managing cloud software, is vulnerable to a command injection flaw. An attacker with permissions to upload software releases can craft a malicious file that, when processed, executes unauthorized commands on the BOSH Director server. This could lead to a full takeover of the deployment infrastructure and access to sensitive configuration data.
Technical details
An OS command injection vulnerability exists in the 'ReleaseJob#unpack' method of BOSH Director. The vulnerability is caused by the improper neutralization of the 'name' field within the 'release.MF' manifest file of an uploaded release tarball. This value is taken verbatim and interpolated into a shell command string used to execute 'tar' via 'Bosh::Common::Exec.sh', which utilizes '/bin/sh -c'. An attacker with 'bosh.releases.upload' permissions can include shell metacharacters (such as backticks or subshell syntax) in the job name to achieve arbitrary code execution on the BOSH Director VM. The issue is fixed in BOSH Director version v282.1.12.
Affected products
- Cloud Foundry Foundation BOSH Director prior to v282.1.12
Timeline
- 2026-06-02: advisory: Initial advisory published by Cloud Foundry Foundation
- 2026-06-04: disclosed: NVD publication date