Aviatrix Controller: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CVE-2024-50603) #shorts

Summary

Today we're discussing a critical vulnerability identified as CVE-2024-50603, which has been discovered in the Aviatrix Controller. This issue allows for remote code execution through improper handling of special elements in OS commands. The vulnerability is actively being exploited, which makes it imperative for affected users to update their systems immediately.

Product details

The affected product in this vulnerability is the Aviatrix Controller software. Specifically, versions before 7.1.4191 and 7.2.x before 7.2.4996 are susceptible to this security flaw. This software is a key component in cloud network management, allowing enterprises to manage and secure their cloud resources effectively.

Vulnerability type summary

The vulnerability type is categorized under CWE-78, which denotes improper neutralization of special elements used in an OS Command, also known as OS Command Injection. This type of vulnerability can allow attackers to execute arbitrary commands on the host system.

Details of the vulnerability

The issue arises because of the failure to properly neutralize special elements, or shell metacharacters, within API calls of the Aviatrix Controller. Specifically affected are the functions for 'list_flightpath_destination_instances' and 'flightpath_connection_test' in the API version /v1. If exploited, this flaw allows an unauthenticated attacker to execute arbitrary code, thus potentially gaining unauthorized access and control over the affected system.

Conclusion

In conclusion, CVE-2024-50603 represents a significant security threat due to its exploitation potential and the fact that it is actively being leveraged in the wild. Users of Aviatrix Controller should prioritize patching and updating their systems to version 7.1.4191 or 7.2.4996 and beyond to mitigate this risk. As always, maintaining an updated security posture is crucial in protecting against threats like these.

This chain involves the following actors

This following systems are involved

Attack entry point

Remediation actions

Exploitation actions

• https://docs.aviatrix.com/documentation/latest/network-security/index.html
• https://docs.aviatrix.com/documentation/latest/release-notices/psirt-advisories/psirt-advisories.html?expand=true#remote-code-execution-vulnerability-in-aviatrix-controllers
• https://www.securing.pl/en/cve-2024-50603-aviatrix-network-controller-command-injection-vulnerability/