Listen to this Post
The CVE-2025-59302 vulnerability in Apache CloudStack is a code injection issue that allows administrative users to execute arbitrary code through specific APIs. This occurs due to improper control of JavaScript expression interpretation in the affected API endpoints. The APIs involved are quotaTariffCreate, quotaTariffUpdate, createSecondaryStorageSelector, updateSecondaryStorageSelector, updateHost, and updateStorage, all of which require admin privileges. When an admin sends crafted requests to these APIs, the system interprets JavaScript code embedded in the input, leading to code execution on the CloudStack management server. This vulnerability affects versions from 4.18.0 up to but not including 4.20.2, and from 4.21.0 up to but not including 4.22.0. To address this, Apache released fixed versions 4.20.2 and 4.22.0, which include a new configuration parameter, js.interpretation.enabled, that allows administrators to enable or disable JavaScript interpretation in these APIs, thus preventing code injection by restricting the execution of untrusted code. The fix mitigates the risk by giving admins control over this feature, and users are urged to upgrade or adjust settings accordingly.
Platform: Apache CloudStack
Version: Versions before 4.20.2/4.22.0
Vulnerability: Code Injection
Severity: Not specified
date: 2025-11-27
Prediction: Patched in 4.20.2/4.22.0
What Undercode Say:
Analytics
Check CloudStack version
cat /etc/cloudstack/version
Verify affected APIs
grep -r “quotaTariff\|SecondaryStorageSelector\|updateHost\|updateStorage” /usr/share/cloudstack-management/
Disable JS interpretation
mysql -u cloud -p cloud -e “UPDATE configuration SET value=’false’ WHERE name=’js.interpretation.enabled’;”
how Exploit:
Authenticated admin sends API request with JavaScript payload to vulnerable endpoints, e.g., quotaTariffCreate, triggering code execution on server.
Protection from this CVE
Upgrade to 4.20.2/4.22.0; set js.interpretation.enabled=false.
Impact:
Remote code execution by admins, compromising management server and infrastructure.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
