CVE-2024-50603

What it actually does

CVE-2024-50603 is an unauthenticated OS command injection vulnerability in Aviatrix Controller. The vulnerable API endpoint `/v1/api` improperly passes user-controlled values from `cloud_type` in `list_flightpath_destination_instances` and `src_cloud_type` in `flightpath_connection_test` into operating-system commands without sufficient neutralization. An attacker who can reach the controller API can inject shell metacharacters and execute arbitrary commands with the privileges of the controller service, potentially leading to full appliance compromise, credential theft, cloud control-plane abuse, persistence, and lateral movement.

Why it matters to the business

A compromised Aviatrix Controller can give an attacker a powerful foothold into cloud networking operations, including visibility into cloud connectivity, routes, credentials, VPN/transit configuration, and connected cloud accounts. Because this vulnerability is listed in CISA KEV, has active in-the-wild exploitation, and has a very high EPSS score, exposed controllers should be treated as high-priority internet-facing infrastructure risk. The KEV remediation deadline of 2025-02-06 has passed, so unpatched systems represent an overdue critical exposure that may affect audit, compliance, and incident-response posture.

How an attack unfolds

An attacker first identifies an Aviatrix Controller reachable over the network, commonly through internet exposure or access to a management network. The attacker sends a crafted request to `/v1/api` using one of the vulnerable actions, placing shell metacharacters in the `cloud_type` or `src_cloud_type` parameter. Because the controller fails to safely neutralize those characters before invoking an OS command, the injected command is executed on the underlying host. After initial command execution, the attacker typically verifies execution, downloads or stages tooling, establishes persistence, enumerates controller configuration and secrets, and uses the controller’s cloud-networking trust relationships to expand access. Public reporting and KEV status indicate this flaw has been exploited in the wild, so suspicious historical activity should be investigated even after patching.

How to fix it

Upgrade Aviatrix Controller immediately to a fixed release: 7.1.4191 or later for the 7.1 branch, or 7.2.4996 or later for the 7.2 branch. If immediate upgrade is not possible, restrict access to the controller management/API interface to trusted administrative networks only, block public internet access, enforce VPN or bastion-only administration, and apply compensating controls at firewalls, security groups, WAFs, and reverse proxies to deny suspicious `/v1/api` requests containing shell metacharacters in `cloud_type` or `src_cloud_type`. Because exploitation is unauthenticated and active, patching alone is not sufficient for exposed systems; perform post-upgrade compromise assessment, rotate credentials and API keys available to the controller, review cloud IAM roles and trust relationships, and rebuild the controller from a known-good image if compromise is suspected.

How to confirm the fix worked

Confirm the installed Aviatrix Controller version is 7.1.4191 or later on the 7.1 branch, or 7.2.4996 or later on the 7.2 branch. Verify that the controller API is not reachable from untrusted networks and that only approved administrative sources can access `/v1/api`. Review web/API logs for historical requests to `/v1/api` invoking `list_flightpath_destination_instances` with `cloud_type` or `flightpath_connection_test` with `src_cloud_type`, especially where parameter values contain semicolons, pipes, backticks, `$()`, redirection operators, URL-encoded metacharacters, or command names. Validate that WAF/firewall rules block unauthenticated requests with command-injection patterns. On the host, verify there are no unexpected processes, cron entries, modified startup scripts, suspicious files in temporary directories, unauthorized SSH keys, or unexpected outbound connections after the upgrade.

Typical attack path

1. Identify an exposed or reachable Aviatrix Controller management/API interface.
2. Send unauthenticated requests to `/v1/api` using `list_flightpath_destination_instances` or `flightpath_connection_test`.
3. Inject shell metacharacters through `cloud_type` or `src_cloud_type` to cause command execution.
4. Run reconnaissance commands on the controller host to determine privileges, network access, and available tools.
5. Retrieve configuration, credentials, tokens, SSH keys, or cloud integration material stored on or accessible to the controller.
6. Stage additional payloads or persistence mechanisms such as scripts, cron entries, web-accessible files, or reverse shells.
7. Use controller trust relationships and cloud-network visibility to pivot into connected environments or manipulate network paths.

How to detect it

Hunt across Aviatrix Controller access logs, API/application logs, reverse proxy logs, WAF logs, Linux system logs, process execution telemetry, EDR events, DNS logs, firewall logs, and cloud audit logs. Prioritize requests to `/v1/api` using `action=list_flightpath_destination_instances` with `cloud_type` or `action=flightpath_connection_test` with `src_cloud_type`. Look for shell metacharacters in those parameters, including `;`, `|`, `&`, backticks, `$()`, `>`, `<`, newline encodings, and URL-encoded variants such as `%3B`, `%7C`, `%26`, `%60`, `%24%28`, `%3E`, and `%0A`. On the controller host, investigate suspicious child processes spawned by web/API service contexts, including `sh`, `bash`, `curl`, `wget`, `python`, `perl`, `nc`, `ncat`, `socat`, `openssl`, or package managers. Look for files created in `/tmp`, `/var/tmp`, `/dev/shm`, unexpected cron entries, modified init/systemd units, new SSH authorized keys, unusual outbound DNS/HTTP connections, and cloud configuration or credential access shortly after suspicious API requests. Because public exploitation is reported, absence of a known malware IOC does not rule out compromise; focus on exploit behavior and post-exploitation activity.

• /v1/api
• list_flightpath_destination_instances
• flightpath_connection_test
• cloud_type=
• src_cloud_type=
• action=list_flightpath_destination_instances
• action=flightpath_connection_test
• cloud_type=%3B
• cloud_type=%7C
• cloud_type=%26
• cloud_type=%60
• cloud_type=%24%28
• cloud_type=%0A
• src_cloud_type=%3B
• src_cloud_type=%7C
• src_cloud_type=%26
• src_cloud_type=%60
• src_cloud_type=%24%28
• src_cloud_type=%0A
• ;curl
• ;wget
• |curl
• |wget
• `curl
• `wget
• $(curl
• $(wget
• /bin/sh
• /bin/bash
• /tmp/
• /var/tmp/
• /dev/shm/
• authorized_keys
• crontab -e
• /etc/cron
• /etc/systemd/system

What your security team should do

• Treat any internet-exposed unpatched Aviatrix Controller as potentially compromised due to KEV status, active exploitation, and very high EPSS probability.
• Upgrade immediately to Aviatrix Controller 7.1.4191 or later, or 7.2.4996 or later, and confirm the version after maintenance.
• Remove public access to the controller management/API interface; allow access only from trusted administrative networks, VPNs, or bastions.
• Perform retrospective log hunting for exploitation attempts against `/v1/api`, especially the vulnerable actions and parameters with shell metacharacters or URL-encoded command syntax.
• Collect and preserve controller web/API logs, system logs, process history, shell history, cron configuration, and relevant cloud audit logs before rebuilding or making major changes.
• Rotate secrets accessible to the controller, including cloud credentials, API tokens, SSH keys, and integration credentials, if exploitation is suspected or cannot be ruled out.
• Review cloud IAM activity and network changes made through or around the controller after the first suspicious request timestamp.
• Consider rebuilding from a known-good image rather than only cleaning artifacts if there is evidence of arbitrary command execution.
• Add SIEM detections for suspicious `/v1/api` requests, unexpected child processes spawned by controller/web services, and outbound connections from the controller to unknown destinations.