CVE-2024-50603
Aviatrix Controllers OS Command Injection Vulnerability
Description
CVE-2024-50603 is a critical-severity OS command injection vulnerability in Aviatrix Controller that allows a remote unauthenticated attacker to execute arbitrary code on the affected system. With a CVSS v3.1 base score of 10.0 — the maximum possible score — the flaw stems from improper neutralization of special elements in OS commands, where shell metacharacters can be injected through the cloud_type parameter in list_flightpath_destination_instances or the src_cloud_type parameter in flightpath_connection_test via the /v1/api endpoint. CISA has added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of February 6, 2025, and the ransomware association is currently classified as unknown. The EPSS score of 94.36% at the 100.0th percentile — the absolute maximum — confirms that this is the most actively exploited class of vulnerability in the entire tracked landscape.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| aviatrix | controller | < 7.1.4191; >= 7.2, < 7.2.4996 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://docs.aviatrix.com/documentation/latest/network-security/index.html(Product)
- https://docs.aviatrix.com/documentation/latest/release-notices/psirt-advisories/psirt-advisories.html?expand=true#remote-code-execution-vulnerability-in-aviatrix-controllers(Vendor Advisory)
- https://www.securing.pl/en/cve-2024-50603-aviatrix-network-controller-command-injection-vulnerability/(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-50603(US Government Resource)
Weakness Type
Unknown CWE
CVE-2024-50603 does not have a specific CWE assigned in the NVD database, but the vulnerability is explicitly described as an OS command injection resulting from improper neutralization of special elements. The Aviatrix Controller's /v1/api endpoint accepts parameters including cloud_type for the list_flightpath_destination_instances action and src_cloud_type for the flightpath_connection_test action. These parameters are incorporated into operating system commands without proper sanitization or escaping of shell metacharacters. An unauthenticated attacker can inject arbitrary shell commands by including metacharacters such as semicolons, backticks, pipe operators, or command substitution sequences in these parameter values. The injected commands execute with the privileges of the Aviatrix Controller process on the underlying operating system. This is a textbook OS command injection vulnerability made exceptionally dangerous by the complete absence of authentication requirements. Learn more about OS Command Injection
Impact Analysis
The impact of CVE-2024-50603 is the maximum possible, with a changed scope that extends compromise beyond the vulnerable component to the entire cloud infrastructure. Confidentiality is fully compromised because the Aviatrix Controller is a centralized cloud networking platform that manages multi-cloud network infrastructure across AWS, Azure, GCP, and OCI. Arbitrary code execution on the controller provides access to cloud API credentials, encryption keys, network configurations, routing tables, and the complete topology of the organization's cloud infrastructure.
Integrity suffers maximum impact as control over the Aviatrix Controller enables the attacker to modify cloud network configurations, alter routing rules to redirect traffic, create new network paths bypassing security controls, modify firewall rules, and deploy additional resources in the cloud environment using the controller's cloud API credentials. The changed scope (S:C) means the attacker's impact extends from the controller itself to all cloud infrastructure managed by it.
Availability is critically threatened because the attacker can disrupt cloud network connectivity for the entire organization, delete network configurations, terminate cloud instances, or deploy destructive payloads across the managed cloud environment. The EPSS score of 94.36% at the 100.0th percentile — the absolute maximum possible — confirms that this is among the single most exploited vulnerabilities in existence. A detailed technical analysis and proof-of-concept exploit is publicly available, making exploitation trivially accessible. The vulnerability affects Aviatrix Controller versions before 7.1.4191 and versions 7.2.x before 7.2.4996, and any internet-exposed controller instance is at immediate risk of complete compromise.
Exploit Maturity
CVE-2024-50603 demonstrates the absolute maximum exploit maturity with a public proof-of-concept exploit available, confirmed active exploitation, and the highest possible EPSS score. CISA has included it in the Known Exploited Vulnerabilities catalog with a remediation deadline of February 6, 2025. The EPSS score of 94.36% at the 100.0th percentile represents the highest exploitation probability achievable, confirming that this vulnerability is being exploited more than virtually any other tracked vulnerability. A detailed technical writeup and exploit are available from Securing.pl.
The combination of maximum CVSS score, maximum EPSS percentile, no authentication requirement, and public exploit availability creates the most dangerous possible threat profile. The Aviatrix Controller is a high-value target because it manages multi-cloud network infrastructure, and compromising it provides attackers with the ability to manipulate the entire cloud networking layer of an organization. The vendor advisory and patching information is available at the Aviatrix PSIRT advisories page. The CISA KEV entry can be reviewed at the KEV catalog. While the ransomware association is classified as unknown, the cloud infrastructure access provided by compromising an Aviatrix Controller enables devastating attacks including data exfiltration, cryptomining, and ransomware deployment across cloud workloads.
Remediation
-
Upgrade Aviatrix Controller immediately to version 7.1.4191 or later (for the 7.1.x branch) or version 7.2.4996 or later (for the 7.2.x branch). Given the maximum CVSS score and active exploitation, this should be treated as the highest possible priority. Consult the Aviatrix PSIRT advisory for specific upgrade instructions.
-
Restrict network access to the Aviatrix Controller so that the /v1/api endpoint and the management interface are not accessible from the public internet. Implement network security groups, firewall rules, or VPN-only access to ensure that only authorized administrators from trusted networks can reach the controller.
-
Conduct an immediate forensic assessment of any Aviatrix Controller instances that were running vulnerable versions while exposed to the internet. Examine system logs, process listings, network connections, and file system changes for indicators of compromise. Check for unauthorized API calls, new user accounts, modified configurations, and unexpected outbound network connections from the controller.
-
Rotate all cloud API credentials managed by or accessible through the Aviatrix Controller if compromise is suspected or cannot be ruled out. This includes AWS IAM access keys, Azure service principal credentials, GCP service account keys, and any other cloud provider credentials configured in the controller. An attacker with command execution on the controller would have had access to these credentials.
-
Review cloud infrastructure configurations for unauthorized changes that may have been made through the compromised controller. Audit network routes, security groups, firewall rules, VPN configurations, and any other networking resources managed by Aviatrix for modifications that could provide the attacker with persistent access or data exfiltration paths.
Technical Details
CVE-2024-50603 is an OS command injection vulnerability in Aviatrix Controller, characterized by the CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Breaking down the vector components: Attack Vector (AV:N) indicates the vulnerability is exploitable over the network through the controller's web API. Attack Complexity (AC:L) means the exploit works reliably without special conditions. Privileges Required (PR:N) confirms no authentication is needed — the vulnerable API endpoint is accessible to unauthenticated users. User Interaction (UI:N) indicates no victim action is required. Scope (S:C) is changed, meaning exploitation of the controller affects resources beyond the controller itself, specifically the entire cloud networking infrastructure it manages, which is why the base score reaches the maximum of 10.0.
The vulnerability exists in the /v1/api endpoint of the Aviatrix Controller. Two specific API actions are vulnerable: list_flightpath_destination_instances (through the cloud_type parameter) and flightpath_connection_test (through the src_cloud_type parameter). These API actions are part of Aviatrix's FlightPath diagnostic tool, which is used for network path analysis across cloud environments. The vulnerable code passes the parameter values directly into shell commands without sanitizing special characters. An attacker can inject shell metacharacters to break out of the intended command context and execute arbitrary commands. For example, supplying a cloud_type value containing a semicolon followed by arbitrary commands causes the shell to execute both the intended command and the attacker's injected commands sequentially. The fix in versions 7.1.4191 and 7.2.4996 implements proper input validation and sanitization for these parameters, preventing shell metacharacter injection. The affected versions span the entire 7.x release line prior to the patched versions.
Frequently Asked Questions
What is CVE-2024-50603?
CVE-2024-50603 is a critical OS command injection vulnerability in Aviatrix Controller with the maximum CVSS score of 10.0. It allows remote unauthenticated attackers to execute arbitrary operating system commands through the /v1/api endpoint by injecting shell metacharacters into the cloud_type or src_cloud_type parameters.
Why does CVE-2024-50603 have the maximum CVSS score of 10.0?
The maximum score results from the combination of network-accessible attack vector, no authentication required, no user interaction needed, low attack complexity, and a changed scope that means compromising the controller affects all cloud infrastructure it manages. Every impact dimension (confidentiality, integrity, availability) is rated at the highest level.
Which Aviatrix Controller versions are affected?
The vulnerability affects Aviatrix Controller versions before 7.1.4191 and versions 7.2.x before 7.2.4996. Organizations should upgrade to the patched versions immediately.
Is there a public exploit available for CVE-2024-50603?
Yes, a detailed technical analysis and proof-of-concept exploit have been published by Securing.pl. Combined with the maximum EPSS score at the 100th percentile, this confirms that the vulnerability is being actively exploited at the highest possible rate.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.