InfoSecBulletin Cybersecurity for mankind
The Apache Software Foundation has warned about two serious security issues (CVE-2024-38346 and CVE-2024-39864) in Apache CloudStack, a popular open-source cloud computing platform. These vulnerabilities are a big threat to organizations using CloudStack to manage their virtualized infrastructure.
Unauthenticated Cluster Service Port (CVE-2024-38346)
B1ack’s Stash Releases 1 Million Credit Cards on a Deep Web Forum
Cisco Confirms
Salt Typhoon Exploited CVE-2018-0171 to Target U.S. Telecom Networks
AWS Key Hunter
Test this free automated tool to hunt for exposed AWS secrets
Check Point Flaw Used to Deploy ShadowPad and Ransomware
CVE-2024-12284
Citrix Issues Security Update for NetScaler Console
CISA and FBI ALERT
Ghost ransomware to breach organizations in 70 countries
Hacker chains multiple vulns to attack Palo Alto Firewall
150 Gov.t Portal affected
Black-Hat SEO Poisoning Indian “.gov.in, .ac.in” domain
CVE-2018-19410 Exposes 600 PRTG Instances in Bangladesh
Builder claims Rs 150 cr for data loss; AWS faces FIR In Bengaluru
The vulnerability CVE-2024-38346 is found in the unauthenticated CloudStack cluster service port (default 9090). It can be exploited by attackers to run commands on hypervisors and CloudStack management servers. This could lead to full control over the CloudStack environment, causing data breaches, service disruptions, and financial losses.
Dynamic Port Assignment in Disabled Integration API Service (CVE-2024-39864)
The CVE-2024-39864 vulnerability affects the CloudStack integration API service. Although it should not be accessible when disabled, it mistakenly listens on a random port. Attackers who can access the CloudStack management network can find this port and use it to perform unauthorized administrative actions and execute remote code on CloudStack managed hosts. This vulnerability increases the risk of a complete infrastructure compromise.
Affected Versions and Urgent Call for Action
Apache CloudStack versions 4.0.0 to 4.18.2.0 and 4.19.0.0 to 4.19.0.1 have serious security flaws. The best way to fix this is to update to versions 4.18.2.1 or 4.19.0.2, which include patches to address these issues.
For organizations unable to upgrade immediately, the following temporary measures are advised:
Limit network access to the cluster service port (default 9090) on CloudStack management server hosts to only their peer management servers. Also, restrict network access on CloudStack management server hosts to only essential ports.
