CyberRota Analysis
AI-GeneratedAuthenticated tenants in Apache CloudStack are vulnerable to Server-Side Request Forgery (SSRF) and remote code execution (RCE) through maliciously crafted metalink files, allowing attackers to execute arbitrary shell commands as root on the KVM hypervisor. This vulnerability can lead to cross-tenant access and compromise the security of other virtual machines hosted on the same hypervisor. Organizations using affected versions (4.14.0.0 to 4.22.1.0) should prioritize upgrading to versions 4.20.3.1 or 4.22.1.1 or later to mitigate these risks.
Original NVD Description
SSRF via Metalink Mirror URL Resolution: An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal targets. The Secondary Storage VM will retrieve the data and persist it as a template file, which can later be downloaded through normal APIs. RCE on KVM hypervisor via NFS, Metalink files with/without Direct Downloads: An authenticated CloudStack tenant holding the default User role can execute arbitrary shell commands as root on the KVM hypervisor host that runs other tenants' VMs. This is cross-tenant root on the underlying compute, reachable via the public CloudStack API. When a User registers a VM template with directDownload=true and a URL pointing to a .metalink file, the management server fetches the metalink XML and dispatches download to the KVM agent. Inner URLs inside the metalink XML are never re-validated against the scheme allowlist. These issues affect Apache CloudStack: from 4.14.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
Related CVEs
Other vulnerabilities affecting the same vendor(s)