This vulnerability (CWE-295) in BOSH occurs due to improper certificate validation in the communication between nats-sync and the BOSH director. Specifically, the Net::HTTP client disables SSL certificate verification for director API calls, enabling a man-in-the-middle attacker to intercept and steal sensitive credentials such as Basic auth headers or UAA client secrets. Additionally, the attacker can manipulate the VM list written into the NATS authorization file. The vulnerability affects all BOSH versions prior to 282.1.9, with a fix introduced in version 282.1.9.

An attacker positioned as a man-in-the-middle can steal administrative credentials for the BOSH director, granting them full administrative access. This compromises the integrity and confidentiality of the director and potentially the entire deployment managed by BOSH. The attacker can also tamper with the VM list used for authorization, potentially disrupting or manipulating VM operations.

A fix is available in BOSH version 282.1.9 and later. Users should upgrade to version 282.1.9 or newer to resolve this vulnerability. Since no official remediation level or temporary fix is stated, upgrading to the fixed version is the recommended action. Patch status is confirmed by the version information in the description.