CVE-2024-42062 Apache CloudStack: User Key Exposure to Domain Admins
Domain admins can view all API keys, including root admin keys, allowing privilege escalation and infrastructure compromise in Apache CloudStack.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-42062?
CVE-2024-42062 is a high-severity missing authorization vulnerability in Apache Cloudstack, published on 7 Aug 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
CloudStack account-users by default use username and password based authentication for API and UI access. Account-users can generate and register randomised API and secret keys and use them for the purpose of API-based automation and integrations. Due to an access permission validation issue that affects Apache CloudStack versions 4.10.0 up to 4.19.1.0, domain admin accounts were found to be able to query all registered account-users API and secret keys in an environment, including that of a root admin. An attacker who has domain admin access can exploit this to gain root admin and other-account privileges and perform malicious operations that can result in compromise of resources integrity and confidentiality, data loss, denial of service and availability of CloudStack managed infrastructure.
Users are recommended to upgrade to Apache CloudStack 4.18.2.3 or 4.19.1.1, or later, which addresses this issue. Additionally, all account-user API and secret keys should be regenerated.
Weakness: CWE-863
Which versions are affected by CVE-2024-42062?
It affects 1 product.
Products include Apache Cloudstack.
How do I fix CVE-2024-42062?
No fix has been published for CVE-2024-42062 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-42062 being exploited?
There is no known exploitation of CVE-2024-42062 in the wild and no public exploit code.
Other vulnerabilities in Apache Cloudstack
- CVE-2012-4501 Missing authorization in n/a
- CVE-2024-38346 Apache CloudStack: Unauthenticated cluster service port leads to remote execution
- CVE-2024-39864 Apache CloudStack: Integration API service uses dynamic port when disabled
- CVE-2024-29006 Apache CloudStack: x-forwarded-for HTTP header parsed by default
- CVE-2022-35741 Apache CloudStack SAML Single Sign-On XXE
Sources
Also known as GHSA-wrfv-q4v6-cw3x.