CVE-2024-50603
An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements...
Basic Information
- CVE State
- PUBLISHED
- Reserved Date
- October 27, 2024
- Published Date
- January 08, 2025
- Last Updated
- January 27, 2025
- Vendor
- Aviatrix
- Product
- Controller
- Description
- An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS command, an unauthenticated attacker is able to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.
CVSS Scores
CVSS v3.1
10.0 - CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
SSVC Information
- Exploitation
- active
- Automatable
- Yes
- Technical Impact
- total
References
https://docs.aviatrix.com/documentation/latest/network-security/index.html
https://docs.aviatrix.com/documentation/latest/release-notices/psirt-advisories/psirt-advisories.html?expand=true#remote-code-execution-vulnerability-in-aviatrix-controllers
https://www.securing.pl/en/cve-2024-50603-aviatrix-network-controller-command-injection-vulnerability/
Known Exploited Vulnerability Information
| Source | Added Date |
|---|---|
| CISA | 2025-01-16 00:00:00 UTC |
Scanner Integrations
| Scanner | URL | Date Detected |
|---|---|---|
| Nuclei | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-50603.yaml | 2025-04-26 00:00:00 UTC |
Potential Proof of Concepts
Warning: These PoCs have not been tested and could contain malware. Use at your own risk.
th3gokul/CVE-2024-50603
Type: github • Created: 2025-01-12 11:20:21 UTC • Stars: 16
CVE-2024-50603: Aviatrix Controller Unauthenticated Command Injection
newlinesec/CVE-2024-50603
Type: github • Created: 2025-01-08 12:00:38 UTC • Stars: 6
CVE-2024-50603-nuclei-poc