CVE-2024-45387

CVE-2024-45387 is an SQL injection flaw in Traffic Ops, the API component of the Apache Traffic Control CDN management platform, affecting version 8.0.0 per the Apache advisory. It is triggered when a user who already holds one of the "admin", "federation", "operations", "portal", or "steering" roles sends a specially crafted PUT request to the Traffic Ops API. Successful injection lets the attacker execute arbitrary SQL against the Traffic Ops database, allowing them to read, modify, or corrupt stored data, consistent with the high confidentiality, integrity, and availability ratings in the 8.8 CVSS score. Any operator running an affected Traffic Ops deployment is exposed, though exploitation requires an authenticated privileged account. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, but EPSS places this flaw in the 99th percentile with roughly a 41.5% probability of exploitation within 30 days, so patching is urgent.

What to do: Upgrade Traffic Ops to Apache Traffic Control 8.0.2 or later as recommended by the advisory. In the meantime, restrict API access to trusted networks and review accounts holding the admin, federation, operations, portal, and steering roles, since any of them can trigger the injection via crafted PUT requests. Check Traffic Ops and database logs for unexpected or anomalous SQL from API activity, and watch for public exploits given the elevated EPSS score.