CVE-2016-0898
📋 TL;DR
MySQL for PCF tiles versions 1.7.x before 1.7.10 log AWS access keys in plaintext to Service Backup component logs. This exposes sensitive credentials that could allow unauthorized access to AWS resources. Only deployments using affected MySQL for PCF tiles versions with AWS integration are impacted.
💻 Affected Systems
- MySQL for PCF tiles
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain access to Service Backup VM logs, extract AWS credentials, and compromise AWS resources including databases, storage, and infrastructure.
Likely Case
Internal actors or compromised systems access backup logs and use credentials for limited AWS resource access before detection.
If Mitigated
Credentials are exposed but access is prevented by network segmentation, log protection, and AWS security controls.
🎯 Exploit Status
Exploitation requires access to the Service Backup VM or its logs, which are typically internal systems.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.7.10
Vendor Advisory: https://pivotal.io/security/cve-2016-0898
Restart Required: Yes
Instructions:
1. Upgrade MySQL for PCF tiles to version 1.7.10 or later. 2. Restart the Service Backup component. 3. Rotate all AWS access keys that may have been logged. 4. Verify logs no longer contain plaintext credentials.
🔧 Temporary Workarounds
Restrict access to Service Backup logs
linuxApply strict file permissions and access controls to Service Backup log directories.
chmod 600 /var/vcap/sys/log/service-backup/*
chown vcap:vcap /var/vcap/sys/log/service-backup/*
Rotate AWS credentials
allImmediately rotate all AWS access keys used by the MySQL for PCF tiles deployment.
🧯 If You Can't Patch
- Implement strict access controls and monitoring for Service Backup VM and its log directories
- Regularly rotate AWS credentials and audit AWS access patterns for anomalies
🔍 How to Verify
Check if Vulnerable:
Check MySQL for PCF tiles version: cf service <service-name> --guid then check tile version in Ops Manager. If version is 1.7.x and < 1.7.10, system is vulnerable.Check Version:
cf service <service-name> --guid | xargs -I {} cf curl /v2/service_instances/{} | jq '.entity.service_plan.entity.service.label'Verify Fix Applied:
After upgrading to 1.7.10+, verify no AWS access keys appear in Service Backup logs: grep -r "AKIA" /var/vcap/sys/log/service-backup/📡 Detection & Monitoring
Log Indicators:
- Plaintext AWS access keys (starting with AKIA) in Service Backup component logs
- Unauthorized access attempts to Service Backup log files
Network Indicators:
- Unusual AWS API calls from Service Backup VM IP addresses
- AWS credential usage from unexpected locations
SIEM Query:
source="/var/vcap/sys/log/service-backup/*" AND "AKIA"