Hackers Exploit Aviatrix Controller Vulnerability to Deploy Backdoors and Crypto Miners
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-50603 | Unauthenticated OS Command Injection (RCE) in Aviatrix Controller CVE-2024-50603 is an unauthenticated OS command injection flaw (CWE-78) in Aviatrix Controllers, rated critical (CVSS 3.1: 9.8), that allows arbitrary code execution. It is triggered by sending shell metacharacters to the controller's /v1/api endpoint - in the cloud_type parameter for the list_flightpath_destination_instances action or the src_cloud_type parameter for the flightpath_connection_test action - where the input is not properly neutralized before being used in an OS command. An attacker who can reach the controller's API gains the ability to run arbitrary commands on the controller, and in observed attacks this has been used to install backdoors and cryptocurrency miners. Organizations running Aviatrix Controller versions before 7.1.4191, or 7.2.x versions before 7.2.4996, are affected. The flaw is being actively exploited: it was added to CISA's Known Exploited Vulnerabilities catalog on 2025-01-16 and carries a 98.5% EPSS probability of exploitation within 30 days. Do: Upgrade to Aviatrix Controller 7.1.4191 or later on the 7.1 branch, or 7.2.4996 or later on the 7.2 branch, per the vendor's instructions; if patching is not immediately possible, restrict network access to the controller's /v1/api endpoint or discontinue use as required by CISA's KEV action. Given active exploitation deploying backdoors and crypto miners, check controllers for signs of compromise (unexpected processes, persistence mechanisms, unusual outbound traffic) and rotate credentials accessible from the controller. | 9.8 | 99% | KEV PoC |
| moderatelikely thousands of controller deployments (estimate; enterprise-only install base, with low thousands of controllers observed internet-exposed in public scans) |
Full article669 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananJan 13, 2025Vulnerability / Cloud Security
A recently disclosed critical security flaw impacting the Aviatrix Controller cloud networking platform has come under active exploitation in the wild to deploy backdoors and cryptocurrency miners.
Cloud security firm Wiz said it's currently responding to "multiple incidents" involving the weaponization of CVE-2024-50603 (CVSS score: 10.0), a maximum severity bug that could result in unauthenticated remote code execution.
Put differently, a successful exploitation of the flaw could permit an attacker to inject malicious operating system commands owing to the fact that certain API endpoints do not adequately sanitize user-supplied input. The vulnerability has been addressed in versions 7.1.4191 and 7.2.4996.
Jakub Korepta, a security researcher at Polish cybersecurity company Securing, has been credited with discovering and reporting the shortcoming. A proof-of-concept (PoC) exploit has since been made publicly available.
Data gathered by the cybersecurity company shows that around 3% of cloud enterprise environments have Aviatrix Controller deployed, out of which 65% of them demonstrate a lateral movement path to administrative cloud control plane permissions. This, in turn, allows for privilege escalation in the cloud environment.
"When deployed in AWS cloud environments, Aviatrix Controller allows privilege escalation by default, making exploitation of this vulnerability a high-impact risk," Wiz researchers Gal Nagli, Merav Bar, Gili Tikochinski, and Shaked Tanchuma said.
Real-world attacks exploiting CVE-2024-50603 are leveraging the initial access to target instances to mine cryptocurrency using XMRig and deploying the Sliver command-and-control (C2) framework, likely for persistence and follow-on exploitation.
"While we have yet to see direct evidence of cloud lateral movement, we do believe it likely that threat actors are utilizing the vulnerability to enumerate the cloud permissions of the host and then pivot to exfiltrating data from the victims' cloud environments," Wiz researchers said.
In light of active exploitation, users are recommended to apply the patches as soon as possible and prevent public access to Aviatrix Controller.
Update
When reached for comment regarding active exploitation of CVE-2024-50603, Aviatrix shared the below statement with The Hacker News -
Aviatrix was notified of the security vulnerability in late October and issued a hot patch in early November. Because of the potential severity of the vulnerability, the patch was issued for numerous versions of software that are now End of Support for nearly 2 years. While we strongly recommend that customers remain current in their software, customers on Controller version 6.7+ who have applied the Security Patch can be protected even if they have not upgraded to the latest versions.
That said, Aviatrix is committed to the highest levels of security and transparency. We take our software and customer's security incredibly seriously, and issuing a patch by itself is not enough. To ensure coverage, we kicked off multiple targeted campaigns working with customers to ensure they were patched in early November. This spanned several channels, including multiple direct outreach campaigns via e-mail, pushing banners in the UI, communicating upon opening support cases, and several other mechanisms. During those campaigns, we also worked with customers to harden their configuration based on best practices to mitigate potential threats beyond the vulnerability.
On December 19th, prior to public disclosure, we released permanent fixes for our currently supported software trains – 7.1 and 7.2. Our bar is high, and our goal was 100% coverage. We were happy to see a very significant portion of our customer base patched and hardened prior to responsibly publicly disclosing the vulnerability on January 7th. We continue to communicate with our customers and are working with those who believe they have been exploited to restore their Aviatrix software to a clean state.
Aviatrix Controller Flaw Added to CISA KEV Catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on January 16, 2025, placed CVE-2024-50603 to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by February 6, 2025.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/01/hackers-exploit-aviatrix-controller.html