CVE-2024-50603
Aviatrix Controllers OS Command Injection Vulnerab - [Actively Exploited]
Description
An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS command, an unauthenticated attacker is able to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.
INFO
Published Date :
Jan. 8, 2025, 1:15 a.m.
Last Modified :
Jan. 23, 2025, 8:44 p.m.
Source :
[email protected]
Remotely Exploitable :
Yes !
Impact Score :
6.0
Exploitability Score :
3.9
CISA KEV (Known Exploited Vulnerabilities)
For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.
Aviatrix Controllers contain an OS command injection vulnerability that could allow an unauthenticated attacker to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
https://docs.aviatrix.com/documentation/latest/release-notices/psirt-advisories/psirt-advisories.html?expand=true ; https://nvd.nist.gov/vuln/detail/CVE-2024-50603
Public PoC/Exploit Available at Github
CVE-2024-50603 has a 4 public PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2024-50603.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
CVE-2024-50603: Aviatrix Controller Unauthenticated Command Injection
Python
CVE-2024-50603-nuclei-poc
A series of KQL queries and analytic rules.
Ostorlab KEV: One-command to detect most remotely known exploitable vulnerabilities. Sourced from CISA KEV, Google's Tsunami, Ostorlab's Asteroid and Bug Bounty programs.
cisa-kev vulnerability 0day cisa exploits
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-50603 vulnerability anywhere in the article.
-
TheCyberThrone
CVE-2025-23082 impacts Veeam Backup for Microsoft Azure
CVE-2025-23082 is a high-severity security vulnerability identified in Veeam Backup for Microsoft Azure, a solution designed to protect workloads running in Microsoft’s Azure cloud environment. This v ... Read more
-
TheCyberThrone
Ivanti fixes Critical Security Vulnerabilities in EPM
OverviewIvanti has recently addressed multiple critical and high-severity vulnerabilities in its Endpoint Manager (EPM) software. These vulnerabilities could allow unauthorized access, remote code exe ... Read more
-
TheCyberThrone
CVE-2024-50603 impacts Aviatrix with Cryptomining
CVE-2024-50603 is a critical security vulnerability identified in the Aviatrix Controller, a cloud networking platform used to manage and secure cloud infrastructure across multiple providers. This vu ... Read more
-
The Register
Cryptojacking, backdoors abound as fiends abuse Aviatrix Controller bug
"Several cloud deployments" are already compromised following the disclosure of the maximum-severity vulnerability in Aviatrix Controller, researchers say. CVE-2024-50603 leads to remote code executio ... Read more
-
Dark Reading
Cloud Attackers Exploit Max-Critical Aviatrix RCE Flaw
Source: Everett Collection Historical via Alamy Stock PhotoMultiple threat actors are actively targeting a recently disclosed maximum-severity security bug in the Aviatrix Controller centralized manag ... Read more
-
BleepingComputer
Hackers exploit critical Aviatrix Controller RCE flaw in attacks
Threat actors are exploiting a critical remote command execution vulnerability, tracked as CVE-2024-50603, in Aviatrix Controller instances to install backdoors and crypto miners. The Aviatrix Control ... Read more
-
The Hacker News
Hackers Exploit Aviatrix Controller Vulnerability to Deploy Backdoors and Crypto Miners
Vulnerability / Cloud Security A recently disclosed critical security flaw impacting the Aviatrix Controller cloud networking platform has come under active exploitation in the wild to deploy backdoor ... Read more
-
Cybersecurity News
0-Click Vulnerability in Samsung S24 Devices: PoC Releases for CVE-2024-49415
A newly published report from Natalie Silvanovich, a security researcher at Google’s Project Zero team, has revealed a critical vulnerability in the Monkey’s Audio (APE) decoder used in Samsung’s S24 ... Read more
-
Cybersecurity News
CVE-2024-50603 (CVSS 10): Critical Command Injection Vulnerability in Aviatrix Controller
Source: Jakub KoreptaJakub Korepta, Principal Security Consultant and Head of Infrastructure Security at Securing, has released a detailed report uncovering a critical command injection vulnerability ... Read more
The following table lists the changes that have been made to the
CVE-2024-50603 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Jan. 23, 2025
Action Type Old Value New Value Added CVSS V3.1 NIST AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Added CWE NIST CWE-78 Added CPE Configuration OR *cpe:2.3:a:aviatrix:controller:*:*:*:*:*:*:*:* versions up to (excluding) 7.1.4191 *cpe:2.3:a:aviatrix:controller:*:*:*:*:*:*:*:* versions from (including) 7.2 up to (excluding) 7.2.4996 Changed Reference Type https://docs.aviatrix.com/documentation/latest/network-security/index.html No Types Assigned https://docs.aviatrix.com/documentation/latest/network-security/index.html Product Changed Reference Type https://docs.aviatrix.com/documentation/latest/release-notices/psirt-advisories/psirt-advisories.html?expand=true#remote-code-execution-vulnerability-in-aviatrix-controllers No Types Assigned https://docs.aviatrix.com/documentation/latest/release-notices/psirt-advisories/psirt-advisories.html?expand=true#remote-code-execution-vulnerability-in-aviatrix-controllers Vendor Advisory Changed Reference Type https://www.securing.pl/en/cve-2024-50603-aviatrix-network-controller-command-injection-vulnerability/ No Types Assigned https://www.securing.pl/en/cve-2024-50603-aviatrix-network-controller-command-injection-vulnerability/ Exploit, Third Party Advisory -
CVE CISA KEV Update by 9119a7d8-5eab-497f-8521-727c672e3725
Jan. 17, 2025
Action Type Old Value New Value Added Date Added 2025-01-16 Added Due Date 2025-02-06 Added Required Action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Added Vulnerability Name Aviatrix Controllers OS Command Injection Vulnerability -
New CVE Received by [email protected]
Jan. 08, 2025
Action Type Old Value New Value Added Description An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS command, an unauthenticated attacker is able to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test. Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Added CWE CWE-78 Added Reference https://docs.aviatrix.com/documentation/latest/network-security/index.html Added Reference https://docs.aviatrix.com/documentation/latest/release-notices/psirt-advisories/psirt-advisories.html?expand=true#remote-code-execution-vulnerability-in-aviatrix-controllers Added Reference https://www.securing.pl/en/cve-2024-50603-aviatrix-network-controller-command-injection-vulnerability/
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-50603 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-50603
weaknesses.