Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability in Apache CloudStack allows unauthorized access to virtual machines belonging to other tenants. An attacker can modify a specific instance setting to control another user's virtual machine, including starting, stopping, or destroying it. This could lead to significant disruption and data compromise.
- Allows control of other users' machines.
- Impacts multi-tenant environments.
- Requires existing user access.
Attack Path
How an attacker could exploit the issue
An attacker can exploit this vulnerability by manipulating a user-editable instance setting to reference a virtual machine (VM) belonging to another tenant within Proxmox. This allows unauthorized access and control over other users' VMs, including starting, stopping, or destroying them. The attack relies on predictable VM IDs and the lack of proper validation of this setting.
- Requires authenticated access.
- Targets instance settings.
- Predictable VM IDs are key.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability allows unauthorized access to other tenants' instances by manipulating a user-editable instance setting. Attackers may find this attractive because it enables full control over targeted virtual machines without requiring elevated privileges beyond a standard user account, provided they can access the CloudStack management interface. However, attackers dislike weaponizing such vulnerabilities if they are not easily discoverable or if exploitation requires specific, pre-existing access and knowledge of the environment.
- Exploitation requires authenticated user.
- No public exploit code observed.
- Recent publication date.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize patching Apache CloudStack to version 4.22.0.1 to address unauthorized cross-tenant access. If immediate patching is not feasible, implement the suggested workaround by adding `proxmox_vmid` to the `user.vm.denied.details` global configuration parameter to prevent user-editable instance settings.
- Apply patch to version 4.22.0.1.
- Block `proxmox_vmid` in global config.
- Monitor logs for suspicious instance access.
