Tim Hess

**Name of the Vulnerable Software and Affected Versions** Steeltoe versions 3.2.2 through 3.3.0 Steeltoe version 4.1.0 **Description** Steeltoe is an open source project providing libraries for building cloud-native applications. An issue exists where management endpoints, when configured to listen on an alternate port via the `Management:Endpoints:Port` configuration, allow access restriction bypass. This occurs because the middleware responsible for restricting access relies on the `Host` HTTP header instead of the actual network socket port. **Recommendations** Update versions 3.2.2 through 3.3.0 to version 3.4.0. Update version 4.1.0 to version 4.2.0. Add explicit ASP.NET Core authorization (`RequireAuthorization`) to all sensitive actuator endpoints. Configure the reverse proxy or load balancer to enforce the `Host` header value to prevent clients from setting an arbitrary port.

**Name of the Vulnerable Software and Affected Versions** Steeltoe.Management.Endpoint versions prior to 4.2.0 Steeltoe.Management.EndpointCore versions prior to 3.4.0 **Description** The `Sanitizer` component in the Environment actuator redacts configuration values by matching key names against a suffix list. However, the default list does not cover the standard .NET pattern `ConnectionStrings:<name>` or Steeltoe Connectors' `Steeltoe:Client:<type>:Default:ConnectionString`. Because there is no value-based scrubbing, full connection string values, including embedded `Password=` and `user:pass@host` segments, are returned verbatim in the '/actuator/env' endpoint responses. **Recommendations** Update Steeltoe.Management.Endpoint to version 4.2.0. Update Steeltoe.Management.EndpointCore to version 3.4.0. Remove `env` from the actuator exposure list. Add `.*connectionstring.*` to `KeysToSanitize` as a defense-in-depth measure. Require authorization on actuator endpoints.

**Name of the Vulnerable Software and Affected Versions** Steeltoe.Management.Endpoint versions prior to 4.2.0 Steeltoe.Management.EndpointCore versions prior to 3.4.0 **Description** Steeltoe actuator endpoints default to `EndpointPermissions.Restricted`, which maps to Cloud Foundry's `read basic data` permission typically granted to low-trust roles like Space Auditors. Sensitive actuators, specifically heap dump, environment, and thread dump, fail to require `EndpointPermissions.Full`, meaning the `read sensitive data` permission flag is not enforced for these endpoints. **Recommendations** Update Steeltoe.Management.Endpoint to version 4.2.0. Update Steeltoe.Management.EndpointCore to version 3.4.0. As a temporary workaround, explicitly set `RequiredPermissions = EndpointPermissions.Full` in the options for `HeapDumpEndpointOptions`, `EnvironmentEndpointOptions`, and `ThreadDumpEndpointOptions`. Avoid using `AddAllActuators()` and instead register only the required actuators individually if heap dump, thread dump, or environment are not needed in production.

**Name of the Vulnerable Software and Affected Versions** Steeltoe.Configuration.Abstractions versions 4.0.0 through 4.1.0 **Description** When MySQL or PostgreSQL service bindings from `VCAP SERVICES` include TLS client credentials, the Connectors library writes these credentials to temporary files in `Path.GetTempPath()` using the `File.CreateText()` function. On Linux systems, `File.CreateText()` creates files with mode `0644` (world-readable) under the process umask, and these files are never deleted. This exposes key material that is otherwise protected at mode `0400` in `/proc/<pid>/environ`. **Recommendations** Update to version 4.2.0. As a temporary workaround, prevent other processes from running in the container under a different UID with access to `/tmp`.