Apache CloudStack: Unsichere Zugriffe auf API/Secret Keys eines Benutzers im selben Domain

This vulnerability allows a malicious Domain Admin to effectively impersonate Admin users within the same CloudStack domain. By obtaining the API key and secret key, the attacker can execute actions as the impersonated Admin, bypassing standard access controls. This could involve creating, modifying, or deleting virtual machines, networks, or storage volumes. The attacker could also access sensitive data stored within CloudStack, potentially leading to data exfiltration or modification. The blast radius extends to any resources accessible by the impersonated Admin user, making this a significant security risk.

Organizations utilizing Apache CloudStack in production environments, particularly those with complex domain hierarchies and a large number of administrative accounts, are at risk. Shared hosting environments where multiple customers share a CloudStack instance are also vulnerable, as a compromised Domain Admin account could potentially impact other tenants.

• apache: Examine CloudStack audit logs for unusual API key access patterns or attempts to impersonate Admin users.

journalctl -u cloudstack-management -f | grep "API key" | grep "Admin"

• apache: Monitor CloudStack API endpoints for unauthorized access attempts.

curl -I https://<cloudstack_management_server>/api/cloudstack/ | grep -i "403 forbidden"

• generic web: Review CloudStack access logs for suspicious activity originating from the ROOT domain.

grep "Domain Admin" /var/log/apache2/access.log

1. 2025-06-10Disclosure

   disclosure

1. Reserviert2025-05-12
2. Veröffentlicht2025-06-10
3. Geändert2026-02-26
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-47849 is to upgrade Apache CloudStack to version 4.20.1.0 or later, which contains the fix. If an immediate upgrade is not feasible, consider implementing stricter access controls and monitoring for suspicious API activity. Review CloudStack's access control policies to ensure the principle of least privilege is enforced. Implement a Web Application Firewall (WAF) with rules to detect and block unauthorized API requests. After upgrading, verify the fix by attempting to access Admin-level APIs with a Domain Admin account and confirming access is denied.