Vulnerability DatabaseCVE-2024-45693

CVE-2024-45693:
Apache CloudStack vulnerability analysis and mitigation

Overview

CVE-2024-45693 is a security vulnerability in Apache CloudStack's web interface that was discovered and disclosed on October 15, 2024. The vulnerability affects Apache CloudStack versions from 4.15.1.0 through 4.18.2.3 and 4.19.0.0 through 4.19.1.1. It involves a request origin validation bypass that could allow attackers to perform Cross-Site Request Forgery (CSRF) attacks against authenticated users (Apache Advisory, NVD).

Technical details

The vulnerability is classified as 'Important' with a CVSS v3.1 base score of 8.8 (HIGH) according to NVD, and 8.0 (HIGH) according to Apache Software Foundation. The vulnerability stems from missing validation of the origin of requests in the web interface, which makes it susceptible to CSRF attacks. The vulnerability is identified as CWE-352 (Cross-Site Request Forgery) (NVD).

Impact

The vulnerability can allow attackers to gain privileges and access to resources of authenticated users, potentially leading to account takeover, disruption of services, exposure of sensitive data, and compromise of resource integrity managed by the platform. The attack requires user interaction as victims must be logged into the Apache CloudStack's web interface (Security Online, Apache Advisory).

Mitigation and workarounds

Users are strongly recommended to upgrade to Apache CloudStack versions 4.18.2.4 or 4.19.1.2 or later, which addresses this vulnerability. The fix has been implemented in these versions to properly validate the origin of requests (Apache Advisory).

Community reactions

The vulnerability was reported by security researchers Arthur Souza and Felipe Olivaes. The Apache CloudStack project has addressed this vulnerability alongside other security issues in their latest release, demonstrating their commitment to maintaining the security of their platform (ASEC).