Description
By default the CloudStack management server honours the x-forwarded-for HTTP header and logs it as the source IP of an API request. This could lead to authentication bypass and other operational problems should an attacker decide to spoof their IP address this way. Users are recommended to upgrade to CloudStack version 4.18.1.1 or 4.19.0.1, which fixes this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache CloudStack | 4.11.0.0 – ≤ 4.18.1.0, 4.19.0.0 | — |
Advisories 1
- WID-SEC-2024-0802 Apache CloudStack: Mehrere Schwachstellen ermöglichen Privilegieneskalation BSI CERT-Bund (WID) · Nov 27, 2024
References
- https://lists.apache.org/thread/82f46pv7mvh95ybto5hn8wlo6g8jhjvp vendor-advisory