Apache CloudStack up to 4.18.2.3/4.19.1.1 Web Interface cross-site request forgery

Summaryinfo

A vulnerability was found in Apache CloudStack up to 4.18.2.3/4.19.1.1. It has been classified as problematic. Affected by this issue is some unknown functionality of the component Web Interface. The manipulation leads to cross-site request forgery. This vulnerability is listed as CVE-2024-45693. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Apache CloudStack up to 4.18.2.3/4.19.1.1. This issue affects an unknown code block of the component Web Interface. The manipulation with an unknown input leads to a cross-site request forgery vulnerability. Using CWE to declare the problem leads to CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. Impacted is integrity. The summary by CVE is:

Users logged into the Apache CloudStack's web interface can be tricked to submit malicious CSRF requests due to missing validation of the origin of the requests. This can allow an attacker to gain privileges and access to resources of the authenticated users and may lead to account takeover, disruption, exposure of sensitive data and compromise integrity of the resources owned by the user account that are managed by the platform. This issue affects Apache CloudStack from 4.15.1.0 through 4.18.2.3 and 4.19.0.0 through 4.19.1.1 Users are recommended to upgrade to Apache CloudStack 4.18.2.4 or 4.19.1.2, or later, which addresses this issue.

It is possible to read the advisory at lists.apache.org. The identification of this vulnerability is CVE-2024-45693 since 09/05/2024. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 4.18.2.4 or 4.19.1.2 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Cloud Software

Vendor

• Apache

Name

• CloudStack

Version

• 4.18.2.0
• 4.18.2.1
• 4.18.2.2
• 4.18.2.3
• 4.19.1.0
• 4.19.1.1

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion