Technical impact
Route Services can be abused to redirect application traffic to network destinations that lie outside the application's prescribed egress rules, allowing an attacker to reach HTTP services on internal networks that the Gorouter can access. The flaw permits a malicious developer with Cloud Foundry access to configure a service that directs traffic to these otherwise protected endpoints, effectively bypassing the firewall configuration embedded in the platform.
Affected Systems
The vulnerability affects the CloudFoundry Foundation Routing release versions 0.118.0 through 0.371.0 inclusive, and the CF Deployment releases from 0.0.2 through 54.14.0. Updates to Routing release 0.372.0 or later, or CF Deployment between 55.0.0 and newer that include Routing release 0.372.0, resolve the issue.
Risk and Exploitability
With a CVSS score of 5, this is considered medium severity. The EPSS score is not available, but the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires the attacker to have permission to configure route services; based on the description it is inferred that a malicious developer with such privileges could set up a route that enables bypassing the egress firewall. The impact is that internal services, previously unreachable by external traffic, can now be accessed by the attacker through the Gorouter.
