CVE-2024-38346 Apache CloudStack: Unauthenticated cluster service port leads to remote execution
Unauthenticated access to the cluster service port allows command injection, leading to remote code execution and full compromise of managed hosts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-38346?
CVE-2024-38346 is a critical command injection vulnerability in Apache Cloudstack, published on 5 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The CloudStack cluster service runs on unauthenticated port (default 9090) that can be misused to run arbitrary commands on targeted hypervisors and CloudStack management server hosts. Some of these commands were found to have command injection vulnerabilities that can result in arbitrary code execution via agents on the hosts that may run as a privileged user. An attacker that can reach the cluster service on the unauthenticated port (default 9090), can exploit this to perform remote code execution on CloudStack managed hosts and result in complete compromise of the confidentiality, integrity, and availability of CloudStack managed infrastructure.
Users are recommended to restrict the network access to the cluster service port (default 9090) on a CloudStack management server host to only its peer CloudStack management server hosts. Users are recommended to upgrade to version 4.18.2.1, 4.19.0.2 or later, which addresses this issue.
Weakness: CWE-94
Which versions are affected by CVE-2024-38346?
It affects 1 product.
Products include Apache Cloudstack.
How do I fix CVE-2024-38346?
No fix has been published for CVE-2024-38346 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-38346 being exploited?
There is no known exploitation of CVE-2024-38346 in the wild and no public exploit code.
Other vulnerabilities in Apache Cloudstack
- CVE-2012-4501 Missing authorization in n/a
- CVE-2024-39864 Apache CloudStack: Integration API service uses dynamic port when disabled
- CVE-2024-29006 Apache CloudStack: x-forwarded-for HTTP header parsed by default
- CVE-2022-35741 Apache CloudStack SAML Single Sign-On XXE
- CVE-2019-17562 Command injection in Apache CloudStack
Sources
Also known as GHSA-7g4v-8cvx-gp5q.