PT-2024-31486 · Apache · Apache Cloudstack
Daniel Augusto Veronezi Salvador
·
Published
2024-10-15
·
Updated
2025-07-01
·
CVE-2024-45219
CVSS v3.1
8.5
High
| Vector | AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Apache CloudStack versions 4.0.0 through 4.18.2.3
Apache CloudStack versions 4.19.0.0 through 4.19.1.1
Description
The issue arises due to missing validation checks for KVM-compatible templates or volumes in Apache CloudStack, allowing an attacker who can upload or register templates and volumes to deploy malicious instances or attach uploaded volumes to existing instances on KVM-based environments. This could result in the compromise of resource integrity and confidentiality, data loss, denial of service, and availability of KVM-based infrastructure managed by CloudStack.
Recommendations
For Apache CloudStack versions 4.0.0 through 4.18.2.3, upgrade to Apache CloudStack 4.18.2.4 or later.
For Apache CloudStack versions 4.19.0.0 through 4.19.1.1, upgrade to Apache CloudStack 4.19.1.2 or later.
Additionally, operators can scan and check all user-uploaded or registered KVM-compatible templates and volumes to ensure they are flat files and do not use any additional or unnecessary features. This can be done by running the command:
for file in $(find /path/to/storage/ -type f -regex [a-f0-9-].); do echo "Retrieving file [$file] info. If the output is not empty, that might indicate a compromised disk; check it carefully."; qemu-img info -U $file | grep file: ; printf "
"; done
on their secondary storage(s) and inspecting the output. An empty output for the disk being validated means it has no references to the host filesystems; on the other hand, if the output for the disk being validated is not empty, it might indicate a compromised disk.
Fix
DoS
Improper Encoding or Escaping of Output
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Apache Cloudstack