This vulnerability in the BOSH ecosystem involves a path traversal flaw (CWE-22) that enables an attacker with access to IaaS metadata to manipulate the BOSH agent into writing files owned by root to arbitrary locations ending with .network. The attacker can also cause the creation of parent directories with overly permissive permissions (0777) via network alias functionality on Ubuntu. The affected versions include all BOSH agent versions before 2.847.0, specifically jammy versions up to 1.1202 and noble versions up to 1.364. The vulnerability has a CVSS 3.1 base score of 4.2, reflecting moderate impact with attack vector requiring adjacent network access and high attack complexity.

An attacker able to control IaaS metadata can exploit this vulnerability to write files as root to arbitrary paths ending in .network, potentially enabling partial control over system configuration or behavior. The creation of directories with mode 0777 could further weaken system security by allowing broad access. However, the CVSS score and vector indicate that exploitation requires high complexity and access to the adjacent network, limiting the ease of attack. There is no indication of confidentiality impact, but integrity and availability impacts are low to moderate.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix link is provided in the available data. Users should monitor vendor communications for updates and consider restricting access to IaaS metadata services to trusted entities to reduce exposure. Since this is not a cloud service, remediation responsibility lies with the user deploying BOSH agents.