Vulnerability · Published Apr 4, 2024 · Assigned by apache

CVE-2024-29006Apache CloudStack: x-forwarded-for HTTP header parsed by default

Critical 9.8

In plain English

A critical-severity authentication bypass by spoofing in Apache CloudStack from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.9%top 40.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

By default the CloudStack management server honours the x-forwarded-for HTTP header and logs it as the source IP of an API request. This could lead to authentication bypass and other operational problems should an attacker decide to spoof their IP address this way. Users are recommended to upgrade to CloudStack version 4.18.1.1 or 4.19.0.1, which fixes this issue.

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache CloudStack	4.11.0.0 – through 4.18.1.04.19.0.0

Weakness: CWE-290 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://lists.apache.org/thread/82f46pv7mvh95ybto5hn8wlo6g8jhjvp vendor-advisory