CVE-2021-40870
Aviatrix Controller Unrestricted Upload of File
Description
CVE-2021-40870 is a critical-severity unrestricted file upload vulnerability in Aviatrix Controller 6.x before version 6.5-1804.1922. The flaw allows an unauthenticated attacker to upload a file with a dangerous type and leverage directory traversal to execute arbitrary code on the affected system. CISA has added CVE-2021-40870 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 93.74% (99.8th percentile), this Aviatrix Controller vulnerability has a near-certain probability of exploitation, making it an urgent priority for organizations using Aviatrix cloud networking infrastructure.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| aviatrix | controller | >= 6.2, < 6.2.2043; >= 6.3, < 6.3.2490; >= 6.4, < 6.4.2838; >= 6.5, < 6.5.1922 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/164461/Aviatrix-Controller-6.x-Path-Traversal-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://docs.aviatrix.com/HowTos/UCC_Release_Notes.html#security-note-9-11-2021(Release Notes, Vendor Advisory)
- https://wearetradecraft.com/advisories/tc-2021-0002/(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40870(US Government Resource)
Weakness Type
CWE-23: Relative Path Traversal
Relative Path Traversal occurs when software uses external input to construct a pathname but fails to properly neutralize sequences such as ".." that can resolve to a location outside of a restricted directory. In CVE-2021-40870, the Aviatrix Controller file upload mechanism does not properly validate uploaded file paths, allowing attackers to use directory traversal sequences to place malicious files in arbitrary locations on the server, ultimately enabling remote code execution.
Learn more: CWE-23 — Relative Path Traversal
Impact Analysis
CVE-2021-40870 carries a CVSS 3.1 score of 9.8 (CRITICAL), the highest severity classification, reflecting the catastrophic potential of this vulnerability. The flaw is remotely exploitable over the network with low attack complexity, requires no authentication, and demands no user interaction, meaning any attacker with network access to the Aviatrix Controller can exploit it without any prerequisites. Confidentiality (High): Successful exploitation through arbitrary code execution grants attackers access to all data on the controller, including cloud infrastructure credentials, API keys, and network configurations. Integrity (High): Attackers can modify cloud networking configurations, alter routing rules, and deploy persistent backdoors across the cloud environment managed by the controller. Availability (High): Code execution can be used to disrupt cloud networking operations, terminate services, and cause widespread outages across connected cloud resources. The EPSS score of 93.74% places this vulnerability in the 99.8th percentile, indicating near-certain exploitation activity. As Aviatrix Controller manages multi-cloud networking, compromise of this system can cascade across entire cloud environments.
Exploit Maturity
CVE-2021-40870 has a mature exploit landscape with confirmed active exploitation. Public exploit code is available via Packet Storm Security and an additional detailed advisory from Tradecraft documenting the exploitation technique. CISA has confirmed active exploitation by including this vulnerability in the KEV catalog with a remediation deadline of 2022-02-01. The EPSS score of 93.74% (99.8th percentile) indicates near-certain exploitation, consistent with the critical severity and the availability of unauthenticated remote code execution capabilities. The combination of no authentication requirement, trivial exploitation complexity, and the high-value target of cloud infrastructure controllers makes this vulnerability exceptionally attractive to threat actors.
Remediation
- Apply vendor patches immediately as required by CISA KEV. Update Aviatrix Controller to version 6.5-1804.1922 or later, which addresses the unrestricted file upload and path traversal vulnerability.
- Verify all Aviatrix Controller deployments are running patched versions. Affected versions include Controller 6.x releases: 6.2 through 6.2.2042, 6.3 through 6.3.2489, 6.4 through 6.4.2837, and 6.5 through 6.5.1921.
- Restrict network access to the Aviatrix Controller management interface immediately. Use security groups, network ACLs, or firewall rules to limit access exclusively to authorized administrator IP addresses, as the vulnerability requires no authentication.
- Implement server-side file upload validation with strict allowlists for permitted file types and enforce canonical path resolution to prevent directory traversal. Ensure uploaded files are stored in isolated directories without execute permissions.
- Monitor Aviatrix Controller logs for indicators of compromise including unexpected file uploads, unusual web server activity, anomalous process execution, and unauthorized configuration changes. Conduct a forensic review of the controller’s filesystem for webshells or other malicious files that may have been uploaded prior to patching.
Technical Details
CVE-2021-40870 is an unrestricted file upload vulnerability combined with relative path traversal (CWE-23) in Aviatrix Controller 6.x before version 6.5-1804.1922. The vulnerability allows an unauthenticated attacker to upload a file with a dangerous type (such as a PHP webshell or executable script) and use directory traversal sequences ("../") in the upload path to place the file in a web-accessible or executable directory, achieving arbitrary code execution on the controller server. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms that the attack is network-based with no prerequisites whatsoever—no authentication, no user interaction, and low complexity. The root cause is CWE-23 (Relative Path Traversal), where the application fails to canonicalize and validate file paths during the upload process, allowing ".." sequences to escape the intended upload directory. The vendor advisory in the Aviatrix release notes documents the security fix applied in the patched versions.
Frequently Asked Questions
Is CVE-2021-40870 being actively exploited?
Yes. CVE-2021-40870 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Public exploit code is available on Packet Storm Security and through independent security advisories. The EPSS score of 93.74% indicates near-certain exploitation probability.
What products are affected by CVE-2021-40870?
CVE-2021-40870 affects Aviatrix Controller version 6.x before 6.5-1804.1922. Specifically, affected version ranges include 6.2 through 6.2.2042, 6.3 through 6.3.2489, 6.4 through 6.4.2837, and 6.5 through 6.5.1921.
How do I fix CVE-2021-40870?
Update the Aviatrix Controller to version 6.5-1804.1922 or later. Until patching is complete, restrict network access to the Controller management interface to trusted administrator IP addresses only, as the vulnerability can be exploited without any authentication.
How severe is CVE-2021-40870?
CVE-2021-40870 has a CVSS 3.1 score of 9.8 (CRITICAL), the maximum severity classification. It allows unauthenticated remote code execution through file upload and directory traversal with no user interaction required. The EPSS score of 93.74% (99.8th percentile) confirms near-certain exploitation activity.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.