Executive brief
Apache CloudStack is an open-source infrastructure-as-a-service platform used to manage cloud computing environments. A command injection vulnerability in the diagnostics APIs allows authenticated administrators to execute arbitrary commands as root on system virtual machines and routers, enabling full compromise of those instances and potential lateral movement to access customer network traffic and infrastructure.
Technical details
A command injection flaw exists in the getDiagnosticsData and runDiagnostics API endpoints within Apache CloudStack's diagnostics functionality for system VMs and virtual routers. The vulnerability stems from improper neutralization of special shell characters in user-supplied input passed to system commands. An authenticated user with Admin role permissions can exploit this to achieve remote code execution as root (or the diagnostics-process user) on affected system VMs and virtual routers. While the APIs are restricted to Admin accounts by default, a compromised or malicious administrator can leverage this to establish a foothold within the managed infrastructure and potentially access guest network traffic. Patched versions 4.20.3.1, 4.22.1.1, and later address this issue.
Affected products
- Apache CloudStack 4.20.0.0 through 4.20.3.0, 4.21.0.0 through 4.22.1.0
Timeline
- 2026-08-21: disclosed