Security Flaw Allowing Malicious Template Registration in Apache CloudStack

CVE-2024-50386

Summary

In Apache CloudStack, account users are permitted by default to register templates for direct download to primary storage, which poses a significant security risk. This vulnerability stems from inadequate validation checks for KVM-compatible templates in several versions. An attacker capable of registering templates could deploy malicious instances on KVM environments, potentially compromising the host filesystem. This could lead to severe consequences, including data loss, integrity issues, and denial of service for KVM infrastructures managed by CloudStack. It is advised to upgrade to version 4.18.2.5 or 4.19.1.3 or later and to perform stringent checks on user-registered KVM templates to ensure they do not possess unnecessary functionalities that could be exploited.

References