CyberSecBulletin
CVE-2022-35741NVD status: Modified

Apache CloudStack: Improper Restriction of XML External Entity Reference

Published Updated By the CyberSecBulletin desk

CVE-2022-35741 is a critical-severity improper restriction of XML external entity reference vulnerability in Apache CloudStack from Apache, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists version Apache CloudStack* as the first without the flaw, so updating Apache CloudStack to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 8.01% chance of exploitation within 30 days, which is in the top 5.14% of all scored CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update Apache CloudStack to Apache CloudStack* or a later version.
  2. Update Cloudstack to 4.16.1.1 or a later version.
  3. Read the advisory on lists.apache.org for workarounds and exact fixed builds.
  4. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
ApacheApache CloudStack4.5.0 up to, but not including, Apache CloudStack*Apache CloudStack*
ApacheCloudstack4.5.0 up to, but not including, 4.16.1.1; 4.17.0.04.16.1.1

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Official description

Apache CloudStack version 4.5.0 and later has a SAML 2.0 authentication Service Provider plugin which is found to be vulnerable to XML external entity (XXE) injection. This plugin is not enabled by default and the attacker would require that this plugin be enabled to exploit the vulnerability. When the SAML 2.0 plugin is enabled in affected versions of Apache CloudStack could potentially allow the exploitation of XXE vulnerabilities. The SAML 2.0 messages constructed during the authentication flow in Apache CloudStack are XML-based and the XML data is parsed by various standard libraries that are now understood to be vulnerable to XXE injection attacks such as arbitrary file reading, possible denial of service, server-side request forgery (SSRF) on the CloudStack management server.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

How developers prevent this class of flaw

  • Many XML parsers and validators can be configured to disable external entity expansion.

More Improper Restriction of XML External Entity Reference vulnerabilities (CWE-611)

Timeline

  1. CVE record published.
  2. Record last changed materially (score, affected products, status or references).

References

Advisories

Patches and release notes

Other vulnerabilities in Apache CloudStack

All Apache CloudStack vulnerabilities

Recent Improper Restriction of XML External Entity Reference vulnerabilities

Spotted an error? Tell us.