Description

Path Traversal in BOSH-Ecosystem / BOSH allows an IaaS-metadata attacker to make the agent write a root-owned file with partially attacker-controlled body to any path ending in .network, and create any missing parent directories with mode 0777 via network Alias on Ubuntu. Affected versions: BOSH agent < v2.847.0 (jammy <= v1.1202, or noble <= v1.364). Lower bound unspecified in advisory ("All bosh agent versions").

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.2",
  "pubDate": "2026-08-06T22:17:04.920Z",
  "pubdate": "2026-08-06T22:17:04.920Z",
  "executiveSummary": "A path traversal vulnerability has been identified within the BOSH-Ecosystem / BOSH agent, specifically involving network Alias handling on Ubuntu operating systems. The vulnerability allows an adversary capable of manipulating IaaS-metadata to force the BOSH agent to write a root-owned file containing a partially attacker-controlled body to arbitrary file paths terminating with the .network extension. Furthermore, the exploitation process automatically creates any missing parent directories with permissive mode 0777 permissions.\nThe affected products include the BOSH agent versions prior to v2.847.0, specifically impacting jammy versions up to v1.1202 and noble versions up to v1.364, with lower bounds unspecified across all BOSH agent iterations. The primary risk implication centers around arbitrary file creation and potential privilege escalation or system misconfiguration via root-owned files with insecure parent directory permissions.\nExploitation requires an attacker to leverage IaaS-metadata interaction capabilities to supply a malicious network Alias payload. The attack vector targets the file writing mechanisms of the agent during network configuration routines, bypassing intended path constraints to target the host filesystem.",
  "technicalDetails": "The root cause of the vulnerability resides in insufficient input validation and path sanitization within the BOSH agent when processing network Alias data retrieved from IaaS-metadata sources on Ubuntu-based deployments. Specifically, the component responsible for generating network configuration files fails to properly restrict the destination directory path when handling alias-derived parameters, permitting directory traversal sequences.\nThe attack flow begins when an adversary compromises or spoofs the IaaS-metadata service to inject malicious parameters into the network Alias configuration retrieved by the BOSH agent. When the agent parses this crafted metadata, it processes the network Alias values to generate local system configuration files.\nDue to the absence of robust path validation, the traversal sequence allows the agent to escape its intended operational directory. Consequently, the agent writes a file owned by the root user to any arbitrary filesystem path that terminates with the .network extension. In addition to writing the file with a partially attacker-controlled body, the vulnerable routine automatically provisions any missing parent directories along the target path, assigning them an overly permissive file mode of 0777.\nPrivilege requirements and authentication are dictated by the attacker's ability to interface with or spoof the IaaS-metadata endpoint queried by the BOSH agent. The component executes with elevated root privileges inherent to the agent architecture, which facilitates the creation of root-owned files and system-level directory structures. Network exposure is localized to the agent's internal communication channel with the local or provisioned IaaS-metadata service.\nThe payload behavior is constrained by the requirement that the target file path must conclude with the .network suffix and that the file body is only partially controllable by the attacker. Nevertheless, the creation of arbitrary root-owned files combined with the instantiation of world-writable (0777) parent directories introduces severe post-exploitation vectors, including potential system tampering, denial of service, or secondary privilege escalation opportunities through subsequent file inclusion or execution flaws."
}