Auth bypass in Apache Cloudstack
CVE-2024-42062
CloudStack account-users by default use username and password based authentication for API and UI access. Account-users can generate and register randomised API and secret keys and use them for the purpose of API-based automation and integrations. Due to an access permission validation issue that affects Apache CloudStack versions 4.10.0 up to 4.19.1.0, domain admin accounts were found to be able to query all registered account-users API and secret keys in an environment, including that of a root admin. An attacker who has domain admin access can exploit this to gain root admin and other-account privileges and perform malicious operations that can result in compromise of resources integrity and confidentiality, data loss, denial of service and availability of CloudStack managed infrastructure. Users are recommended to upgrade to Apache CloudStack 4.18.2.3 or 4.19.1.1, or later, which addresses this issue. Additionally, all account-user API and secret keys should be regenerated.
Vulnerability class: Broken Access Control
EPSS: 0.009 (57.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Apache Cloudstack
- Apache Software Foundation Cloudstack — versions 4.10.0, 4.19.0.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@apache.org (vendor-advisory, patch, Vendor Advisory)
- security@apache.org (mailing-list, Mailing List, Release Notes)
- security@apache.org (Third Party Advisory, third-party-advisory)
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2024-42062?
- CVE-2024-42062 is a high-severity vulnerability in Apache Cloudstack, classified under Incorrect Authorization. CVSS score: 7.2/10. Published 2024-08-07.
- How severe is CVE-2024-42062?
- High severity. CVSS v3 base score is 7.2 out of 10.
- Is CVE-2024-42062 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.