PT-2024-29718 · Apache · Apache Cloudstack

Fabricio Duarte · Published 2024-08-07 · Updated 2024-10-11 · CVE-2024-42062

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.10.0 through 4.19.1.0

Description The issue is caused by an access permission validation problem that allows domain admin accounts to query all registered account-users API and secret keys, including those of the root admin. This can be exploited by an attacker with domain admin access to gain root admin and other-account privileges, resulting in potential compromise of resources integrity and confidentiality, data loss, denial of service, and availability of CloudStack managed infrastructure.

Recommendations For Apache CloudStack versions 4.10.0 through 4.19.1.0, upgrade to Apache CloudStack 4.18.2.3 or 4.19.1.1, or later, which addresses this issue. Additionally, all account-user API and secret keys should be regenerated.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2024-42062

Affected Products

Apache Cloudstack

References · 11

• https://osv.dev/vulnerability/CVE-2024-42062 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-42062 · Security Note
• http://openwall.com/lists/oss-security/2024/08/06/5 · Note
• https://shapeblue.com/shapeblue-security-advisory-apache-cloudstack-security-releases-4-18-2-3-and-4-19-1-1 · Note
• https://cloudstack.apache.org/blog/security-release-advisory-4.19.1.1-4.18.2.3 · Patch, Vendor Advisory
• https://lists.apache.org/thread/lxqtfd6407prbw3801hb4fz3ot3t8wlj · Note
• https://twitter.com/Brandefense/status/1822921026000335143 · Twitter Post
• https://t.me/cvenotify/89590 · Telegram Post
• https://t.me/cvenotify/97864 · Telegram Post
• https://t.me/cvedetector/2674 · Telegram Post
• https://t.me/pentestingnews/50097 · Telegram Post