CVE-2019-17562 Command injection in Apache CloudStack

Critical 9.8 Published 14 May 2020 Updated 5 Aug 2024

Attackers can execute arbitrary shell commands via the mac parameter in Apache CloudStack's baremetal virtual router, requiring an upgrade to fix.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-17562?

CVE-2019-17562 is a critical command injection vulnerability in Apache Cloudstack, published on 14 May 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A buffer overflow vulnerability has been found in the baremetal component of Apache CloudStack. This applies to all versions prior to 4.13.1. The vulnerability is due to the lack of validation of the mac parameter in baremetal virtual router. If you insert an arbitrary shell command into the mac parameter, v-router will process the command. For example: Normal: http://{GW}:10086/baremetal/provisiondone/{mac}, Abnormal: http://{GW}:10086/baremetal/provisiondone/#';whoami;#. Mitigation of this issue is an upgrade to Apache CloudStack 4.13.1.0 or beyond.

Weakness: CWE-119

Which versions are affected by CVE-2019-17562?

It affects 1 product.

Products include Apache Cloudstack.

How do I fix CVE-2019-17562?

No fix has been published for CVE-2019-17562 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2019-17562 being exploited?

There is no known exploitation of CVE-2019-17562 in the wild and no public exploit code.

All Apache Cloudstack vulnerabilities

Sources

Also known as GHSA-2x2h-mgrr-fp68.