CVSS: 8.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-45219 – Apache CloudStack: Uploaded and registered templates and volumes can be used to abuse KVM-based infrastructure
https://notcve.org/view.php?id=CVE-2024-45219
Account users in Apache CloudStack by default are allowed to upload and register templates for deploying instances and volumes for attaching them as data disks to their existing instances. Due to missing validation checks for KVM-compatible templates or volumes in CloudStack 4.0.0 through 4.18.2.3 and 4.19.0.0 through 4.19.1.1, an attacker that can upload or register templates and volumes, can use them to deploy malicious instances or attach uploaded volumes to their existing instances on KVM-based environments and exploit this to gain access to the host filesystems that could result in the compromise of resource integrity and confidentiality, data loss, denial of service, and availability of KVM-based infrastructure managed by CloudStack. Users are recommended to upgrade to Apache CloudStack 4.18.2.4 or 4.19.1.2, or later, which addresses this issue. Additionally, all user-uploaded or registered KVM-compatible templates and volumes can be scanned and checked that they are flat files that should not be using any additional or unnecessary features. For example, operators can run this on their secondary storage(s) and inspect output. An empty output for the disk being validated means it has no references to the host filesystems; on the other hand, if the output for the disk being validated is not empty, it might indicate a compromised disk. for file in $(find /path/to/storage/ -type f -regex [a-f0-9\-]*.*); do echo "Retrieving file [$file] info. If the output is not empty, that might indicate a compromised disk; check it carefully • https://cloudstack.apache.org/blog/security-release-advisory-4.18.2.4-4.19.1.2 https://lists.apache.org/thread/ktsfjcnj22x4kg49ctock3d9tq7jnvlo https://www.shapeblue.com/shapeblue-security-advisory-apache-cloudstack-security-releases-4-18-2-4-and-4-19-1-2 • CWE-20: Improper Input Validation CWE-116: Improper Encoding or Escaping of Output •
CVSS: 5.7EPSS: 0%CPEs: 2EXPL: 0CVE-2024-45461 – Apache CloudStack Quota plugin: Access checks not enforced in Quota
https://notcve.org/view.php?id=CVE-2024-45461
The CloudStack Quota feature allows cloud administrators to implement a quota or usage limit system for cloud resources, and is disabled by default. In environments where the feature is enabled, due to missing access check enforcements, non-administrative CloudStack user accounts are able to access and modify quota-related configurations and data. This issue affects Apache CloudStack from 4.7.0 through 4.18.2.3; and from 4.19.0.0 through 4.19.1.1, where the Quota feature is enabled. Users are recommended to upgrade to Apache CloudStack 4.18.2.4 or 4.19.1.2, or later, which addresses this issue. Alternatively, users that do not use the Quota feature are advised to disabled the plugin by setting the global setting "quota.enable.service" to "false". La función Cuota de CloudStack permite a los administradores de la nube implementar un sistema de cuota o límite de uso para los recursos de la nube y está deshabilitada de forma predeterminada. • https://cloudstack.apache.org/blog/security-release-advisory-4.18.2.4-4.19.1.2 https://lists.apache.org/thread/ktsfjcnj22x4kg49ctock3d9tq7jnvlo • CWE-269: Improper Privilege Management •
CVSS: 6.3EPSS: 0%CPEs: 2EXPL: 0CVE-2024-45462 – Apache CloudStack: Incomplete session invalidation on web interface logout
https://notcve.org/view.php?id=CVE-2024-45462
The logout operation in the CloudStack web interface does not expire the user session completely which is valid until expiry by time or restart of the backend service. An attacker that has access to a user's browser can use an unexpired session to gain access to resources owned by the logged out user account. This issue affects Apache CloudStack from 4.15.1.0 through 4.18.2.3; and from 4.19.0.0 through 4.19.1.1. Users are recommended to upgrade to Apache CloudStack 4.18.2.4 or 4.19.1.2, or later, which addresses this issue. La operación de cierre de sesión en la interfaz web de CloudStack no hace que la sesión del usuario caduque por completo, lo que es válido hasta que caduque por tiempo o se reinicie el servicio de backend. Un atacante que tenga acceso al navegador de un usuario puede usar una sesión vigente para obtener acceso a los recursos que posee la cuenta de usuario que cerró la sesión. • https://cloudstack.apache.org/blog/security-release-advisory-4.18.2.4-4.19.1.2 https://lists.apache.org/thread/ktsfjcnj22x4kg49ctock3d9tq7jnvlo • CWE-613: Insufficient Session Expiration •
CVSS: 8.0EPSS: 0%CPEs: 2EXPL: 0CVE-2024-45693 – Apache CloudStack: Request origin validation bypass makes account takeover possible
https://notcve.org/view.php?id=CVE-2024-45693
Users logged into the Apache CloudStack's web interface can be tricked to submit malicious CSRF requests due to missing validation of the origin of the requests. This can allow an attacker to gain privileges and access to resources of the authenticated users and may lead to account takeover, disruption, exposure of sensitive data and compromise integrity of the resources owned by the user account that are managed by the platform. This issue affects Apache CloudStack from 4.15.1.0 through 4.18.2.3 and 4.19.0.0 through 4.19.1.1 Users are recommended to upgrade to Apache CloudStack 4.18.2.4 or 4.19.1.2, or later, which addresses this issue. Los usuarios que hayan iniciado sesión en la interfaz web de Apache CloudStack pueden ser engañados para que envíen solicitudes CSRF maliciosas debido a la falta de validación del origen de las solicitudes. Esto puede permitir que un atacante obtenga privilegios y acceso a los recursos de los usuarios autenticados y puede provocar la apropiación de cuentas, interrupciones, exposición de datos confidenciales y comprometer la integridad de los recursos propiedad de la cuenta de usuario que son administrados por la plataforma. Este problema afecta a Apache CloudStack desde la versión 4.15.1.0 hasta la 4.18.2.3 y desde la versión 4.19.0.0 hasta la 4.19.1.1. • https://cloudstack.apache.org/blog/security-release-advisory-4.18.2.4-4.19.1.2 https://lists.apache.org/thread/ktsfjcnj22x4kg49ctock3d9tq7jnvlo • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 0CVE-2024-45217 – Apache Solr: ConfigSets created during a backup restore command are trusted implicitly
https://notcve.org/view.php?id=CVE-2024-45217
Insecure Default Initialization of Resource vulnerability in Apache Solr. New ConfigSets that are created via a Restore command, which copy a configSet from the backup and give it a new name, are created without setting the "trusted" metadata. ConfigSets that do not contain the flag are trusted implicitly if the metadata is missing, therefore this leads to "trusted" ConfigSets that may not have been created with an Authenticated request. "trusted" ConfigSets are able to load custom code into classloaders, therefore the flag is supposed to only be set when the request that uploads the ConfigSet is Authenticated & Authorized. This issue affects Apache Solr: from 6.6.0 before 8.11.4, from 9.0.0 before 9.7.0. This issue does not affect Solr instances that are secured via Authentication/Authorization. Users are primarily recommended to use Authentication and Authorization when running Solr. However, upgrading to version 9.7.0, or 8.11.4 will mitigate this issue otherwise. Vulnerabilidad de inicialización predeterminada insegura de recursos en Apache Solr. Los nuevos ConfigSets que se crean mediante un comando de restauración, que copian un configSet de la copia de seguridad y le dan un nuevo nombre, se crean sin configurar los metadatos "confiables". • https://solr.apache.org/security.html#cve-2024-45217-apache-solr-configsets-created-during-a-backup-restore-command-are-trusted-implicitly • CWE-1188: Initialization of a Resource with an Insecure Default •