In Steeltoe.Configuration.Abstractions versions 4.0.0 through 4.1.0, when TLS client credentials are included in MySQL or PostgreSQL service bindings from `VCAP_SERVICES`, the Connectors library writes these credentials to temporary files using `File.CreateText` in the system temporary directory. On Linux, this method creates files with mode 0644 (world-readable) under the process umask, exposing sensitive information to other users on the system. Additionally, these temporary files are not deleted after use, increasing the risk of unauthorized access. The same credentials are otherwise protected with stricter permissions (0400) in the process environment. This issue is fixed in version 4.2.0 by changing how the credentials are stored. If upgrading immediately is not feasible, it is recommended to restrict access to the temporary directory by preventing other processes running under different UIDs from accessing it.

The vulnerability allows local users with access to the temporary directory on Linux systems to read sensitive TLS client credentials stored in temporary files with world-readable permissions. This exposure can lead to unauthorized disclosure of sensitive information, potentially compromising secure connections to MySQL or PostgreSQL services. There is no indication of impact on integrity or availability. The CVSS score of 4.7 reflects a medium severity with a requirement for local access and high attack complexity.

Steeltoe.Configuration.Abstractions version 4.2.0 includes a fix for this vulnerability. Users are advised to upgrade to version 4.2.0 or later to eliminate the insecure storage of TLS credentials. If immediate upgrading is not possible, mitigate the risk by preventing other processes running under different user IDs from accessing the container's temporary directory (e.g., /tmp) to restrict exposure of the temporary files containing sensitive credentials.