CVE-2024-50603
Published: 08 January 2025
Summary
CVE-2024-50603 is a critical-severity OS Command Injection (CWE-78) vulnerability in Aviatrix Controller. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 0.0% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the command injection vulnerability by requiring timely flaw remediation through upgrading to fixed Aviatrix Controller versions 7.1.4191 or 7.2.4996.
Prevents exploitation by implementing input validation at vulnerable API endpoints to neutralize shell metacharacters in cloud_type and src_cloud_type parameters before OS command execution.
Facilitates early identification of CVE-2024-50603 via regular vulnerability scanning, enabling remediation before exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated command injection in public-facing Aviatrix Controller API directly enables T1190 (Exploit Public-Facing Application) for arbitrary code execution.
NVD Description
An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS command, an unauthenticated attacker is able to execute arbitrary code. Shell metacharacters can be sent…
more
to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.
Deeper analysisAI
CVE-2024-50603 is a command injection vulnerability (CWE-78) discovered in Aviatrix Controller versions before 7.1.4191 and 7.2.x before 7.2.4996. The issue stems from improper neutralization of special elements used in an OS command, enabling attackers to inject shell metacharacters via the /v1/api endpoint. Specifically, the cloud_type parameter in list_flightpath_destination_instances or the src_cloud_type parameter in flightpath_connection_test can be abused to execute arbitrary code.
An unauthenticated attacker can exploit this vulnerability remotely with low attack complexity, no user interaction, and no privileges required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, base score 10.0). Successful exploitation grants arbitrary code execution on the Aviatrix Controller, potentially compromising the entire system with high impacts to confidentiality, integrity, and availability, along with a changed scope.
Aviatrix advisories recommend upgrading to version 7.1.4191 or 7.2.4996 to mitigate the vulnerability. The issue is documented in Aviatrix PSIRT release notices and other security resources, with the vulnerability also listed in the CISA Known Exploited Vulnerabilities Catalog.
Details
- CWE(s)
- KEV Date Added
- 16 January 2025