CVE-2024-50603

CVE-2024-50603 is an unauthenticated OS command injection flaw (CWE-78) in Aviatrix Controllers, rated critical (CVSS 3.1: 9.8), that allows arbitrary code execution. It is triggered by sending shell metacharacters to the controller's /v1/api endpoint - in the cloud_type parameter for the list_flightpath_destination_instances action or the src_cloud_type parameter for the flightpath_connection_test action - where the input is not properly neutralized before being used in an OS command. An attacker who can reach the controller's API gains the ability to run arbitrary commands on the controller, and in observed attacks this has been used to install backdoors and cryptocurrency miners. Organizations running Aviatrix Controller versions before 7.1.4191, or 7.2.x versions before 7.2.4996, are affected. The flaw is being actively exploited: it was added to CISA's Known Exploited Vulnerabilities catalog on 2025-01-16 and carries a 98.5% EPSS probability of exploitation within 30 days.

What to do: Upgrade to Aviatrix Controller 7.1.4191 or later on the 7.1 branch, or 7.2.4996 or later on the 7.2 branch, per the vendor's instructions; if patching is not immediately possible, restrict network access to the controller's /v1/api endpoint or discontinue use as required by CISA's KEV action. Given active exploitation deploying backdoors and crypto miners, check controllers for signs of compromise (unexpected processes, persistence mechanisms, unusual outbound traffic) and rotate credentials accessible from the controller.