Threat actors exploit Aviatrix Controller flaw to deploy backdoors and cryptocurrency miners
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-50603 | Unauthenticated OS Command Injection (RCE) in Aviatrix Controller CVE-2024-50603 is an unauthenticated OS command injection flaw (CWE-78) in Aviatrix Controllers, rated critical (CVSS 3.1: 9.8), that allows arbitrary code execution. It is triggered by sending shell metacharacters to the controller's /v1/api endpoint - in the cloud_type parameter for the list_flightpath_destination_instances action or the src_cloud_type parameter for the flightpath_connection_test action - where the input is not properly neutralized before being used in an OS command. An attacker who can reach the controller's API gains the ability to run arbitrary commands on the controller, and in observed attacks this has been used to install backdoors and cryptocurrency miners. Organizations running Aviatrix Controller versions before 7.1.4191, or 7.2.x versions before 7.2.4996, are affected. The flaw is being actively exploited: it was added to CISA's Known Exploited Vulnerabilities catalog on 2025-01-16 and carries a 98.5% EPSS probability of exploitation within 30 days. Do: Upgrade to Aviatrix Controller 7.1.4191 or later on the 7.1 branch, or 7.2.4996 or later on the 7.2 branch, per the vendor's instructions; if patching is not immediately possible, restrict network access to the controller's /v1/api endpoint or discontinue use as required by CISA's KEV action. Given active exploitation deploying backdoors and crypto miners, check controllers for signs of compromise (unexpected processes, persistence mechanisms, unusual outbound traffic) and rotate credentials accessible from the controller. | 9.8 | 99% | KEV PoC |
| moderatelikely thousands of controller deployments (estimate; enterprise-only install base, with low thousands of controllers observed internet-exposed in public scans) |
Full article393 words · extracted from securityaffairs.com · click to collapse
A critical vulnerability in Aviatrix Controller is actively exploited to deploy backdoors and cryptocurrency miners in the wild.
A security researcher Jakub Korepta discovered a critical vulnerability, tracked as CVE-2024-50603 (CVSS score: 10.0), in the Aviatrix Controller.
The flaw impacts Aviatrix Controller pre-7.1.4191 and 7.2.x pre-7.2.4996, it allows unauthenticated attackers to execute arbitrary code via improper command neutralization in the API.
The vulnerability is caused by the improper neutralization of user-supplied input, and has been addressed in patched versions 7.1.4191 and 7.2.4996.
The Wiz Incident Response team reported that threat actors are exploiting the flaw in attacks in the wild to deploy backdoors and cryptocurrency miners.
“The Wiz Incident Response team is currently responding to multiple incidents involving CVE-2024-50603, an Aviatrix Controller unauthenticated RCE vulnerability, that can lead to privileges escalation in the AWS control plane.” reads the advisory published by Wiz. “Organizations should patch urgently.”
A proof-of-concept (PoC) exploit is publicly available.
Aviatrix’s PSIRT confirmed the active exploitation of the flaw.
“A vulnerability could allow an unauthenticated user to execute arbitrary command against Aviatrix Controllers.” reads the PSIRT’s advisory. “Aviatrix has seen indications that bad actors are attempting to exploit this vulnerability, and strongly recommends that you take action to protect your controllers.”
In AWS, Aviatrix Controller’s default privilege escalation amplifies the risk of exploitation, enabling cryptojacking and backdoor attacks, per Wiz Research.
According to data gathered by Wiz, around 3% of cloud enterprise environments have Aviatrix Controller deployed. The experts warn that 65% of such environments, the virtual machine hosting Aviatrix Controller, has a lateral movement path to administrative cloud control plane permissions.
Threat actors exploit the vulnerability to mine cryptocurrency with XMRig, deploy Sliver backdoors, and likely enumerate cloud permissions for potential data exfiltration.
“Our investigation of these instances has shown that the threat actors exploiting this vulnerability are abusing their access to mine cryptocurrency using XMRig and deploy Sliver backdoors, presumably for persistence purposes (to avoid losing access if the infected machine is patched).” Wiz concludes.
“While we have yet to see direct evidence of cloud lateral movement, we do believe it likely that threat actors are utilizing the vulnerability to enumerate the cloud permissions of the host and then pivot to exfiltrating data from the victims’ cloud environments.”
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Aviatrix Controller)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/173037/cyber-crime/aviatrix-controller-flaw-active-exploitation.html