Listen to this Post
In Apache CloudStack, a gap in access control checks affected specific APIs: createNetworkACL, listNetworkACLs, listResourceDetails, listVirtualMachinesUsageHistory, and listVolumesUsageHistory. While these APIs were accessible only to authorized users, insufficient permission validation meant that users could occasionally access information beyond their intended scope. The vulnerability stems from flawed logic in the access control mechanism, where checks for general user authorization were performed but granular resource-level permissions were not properly validated. When authenticated users invoke these APIs, the system fails to comprehensively verify if the user has legitimate rights to the requested resources. This allows users to bypass isolation boundaries, potentially accessing network ACLs, resource details, or usage history data belonging to other tenants or projects. The issue is intermittent, likely depending on specific configurations or request parameters, leading to unauthorized information disclosure. Exploitation requires authenticated access, but with standard user privileges, attackers can craft API calls to retrieve sensitive data. The vulnerability undermines multi-tenancy security in CloudStack deployments, risking data leakage and privacy violations. Patches in versions 4.20.2.0 and 4.22.0.0 address this by strengthening permission validation for these API endpoints.
Platform: Apache CloudStack
Version: Prior to 4.20.2.0
Vulnerability: Access control bypass
Severity: Medium
Date: 11/27/2025
Prediction: Patched in 4.20.2.0
What Undercode Say:
Analytics
curl -X GET -H “API-Key: user_key” http://cloudstack.example.com/client/api?command=listNetworkACLs
curl -X GET -H “API-Key: user_key” http://cloudstack.example.com/client/api?command=listResourceDetails
Check CloudStack version
systemctl status cloudstack-management
cat /etc/cloudstack/version
How Exploit:
Authenticated users call affected APIs with parameters targeting unauthorized resources, exploiting insufficient permission checks to bypass scope restrictions.
Protection from this CVE
Upgrade to Apache CloudStack 4.20.2.0 or 4.22.0.0; implement strict API access controls and audit logs.
Impact:
Unauthorized information disclosure, data leakage, compromised multi-tenancy isolation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
