Description
WebVirtCloud fails to properly validate permission flags in UserInstance grants, allowing view-only users to perform privileged actions. Attackers with read-only grants can power off virtual machines, reset root passwords, install SSH keys, and manage ISO images by exploiting the get_instance gate that only checks grant existence.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| retspen | webvirtcloud | — | — |
References
- GitHub Issue #682 issue-tracking
- https://github.com/retspen/webvirtcloud product
- get_instance checks only that a grant exists, not its flags technical-description
- poweroff authorizes with get_instance alone technical-description
- resizevm_cpu shows the intended is_change enforcement technical-description
- VulnCheck Advisory: WebVirtCloud Missing Authorization on Instance Control Actions third-party-advisory