InfoSecBulletin Cybersecurity for mankind
The Apache Software Foundation has warned about two serious security issues (CVE-2024-38346 and CVE-2024-39864) in Apache CloudStack, a popular open-source cloud computing platform. These vulnerabilities are a big threat to organizations using CloudStack to manage their virtualized infrastructure.
Unauthenticated Cluster Service Port (CVE-2024-38346)
Fortinet + Crowdstrike team on protection from endpoint to firewall
Sophos to Acquire Secureworks in $859M
2nd time hacker breached Internet Archive
Vulnhuntr: A Tool for Finding Exploitable Vulnerabilities with LLMs
Critical Vulnerabilities in Bitdefender Total Security Expose Users to MITM
Microsoft’s Alarming Report: 600 Million Cyberattacks perday
CVE-2024-38814
VMware fixes high-severity SQL injection flaw in HCX
Over 90 Zero-Days, 40+ N-Days Exploited In The Wild
Oracle Security Update, 334 Vulnerabilities Patched
Chrome 130 Launches with Patches for 17 Security Vulnerabilities
The vulnerability CVE-2024-38346 is found in the unauthenticated CloudStack cluster service port (default 9090). It can be exploited by attackers to run commands on hypervisors and CloudStack management servers. This could lead to full control over the CloudStack environment, causing data breaches, service disruptions, and financial losses.
Dynamic Port Assignment in Disabled Integration API Service (CVE-2024-39864)
The CVE-2024-39864 vulnerability affects the CloudStack integration API service. Although it should not be accessible when disabled, it mistakenly listens on a random port. Attackers who can access the CloudStack management network can find this port and use it to perform unauthorized administrative actions and execute remote code on CloudStack managed hosts. This vulnerability increases the risk of a complete infrastructure compromise.
Affected Versions and Urgent Call for Action
Apache CloudStack versions 4.0.0 to 4.18.2.0 and 4.19.0.0 to 4.19.0.1 have serious security flaws. The best way to fix this is to update to versions 4.18.2.1 or 4.19.0.2, which include patches to address these issues.
For organizations unable to upgrade immediately, the following temporary measures are advised:
Limit network access to the cluster service port (default 9090) on CloudStack management server hosts to only their peer management servers. Also, restrict network access on CloudStack management server hosts to only essential ports.
