CVE-2024-42062: Apache CloudStack Privilege Escalation Flaw

CVE-2024-42062 Overview

CVE-2024-42062 is an access control vulnerability in Apache CloudStack affecting versions 4.10.0 through 4.19.1.0. The flaw allows domain admin accounts to query the API and secret keys of all registered account-users, including the root admin. An attacker with domain admin access can retrieve these credentials and impersonate higher-privileged accounts. This leads to full compromise of the CloudStack managed infrastructure, including resource integrity, confidentiality, and availability. The vulnerability is tracked under CWE-863: Incorrect Authorization.

Critical Impact
A domain admin can extract root admin API and secret keys, escalate privileges across the CloudStack environment, and cause data loss or denial of service.

Affected Products

Apache CloudStack 4.10.0 through 4.18.2.2
Apache CloudStack 4.19.0.0 through 4.19.1.0
CloudStack deployments using default username and password authentication for API and UI access

Discovery Timeline

2024-08-07 - CVE-2024-42062 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-42062

Vulnerability Analysis

Apache CloudStack account-users authenticate to the API and UI using a username and password by default. Users can additionally generate randomized API and secret key pairs for automation and integration workflows. The vulnerability stems from an access permission validation failure in the CloudStack API layer. When a domain admin queries registered account-user credentials, the platform fails to restrict results to accounts within the admin's authorized domain scope.

As a result, a domain admin can enumerate API and secret keys belonging to any account in the deployment. This includes the root admin, which holds unrestricted control over all CloudStack resources. The attacker then reuses those keys to authenticate as the target account and issue arbitrary API calls.

Root Cause

The root cause is an incorrect authorization check [CWE-863] in the code path that returns account-user credentials. The API endpoint does not verify that the requesting domain admin owns the target account before disclosing the API and secret keys. This design allows lateral and vertical credential exposure across domain boundaries.

Attack Vector

Exploitation requires authenticated access as a domain admin over the network. The attacker queries CloudStack's account-user listing APIs and extracts the exposed API and secret key material. Using the harvested root admin keys, the attacker signs API requests to provision, modify, or destroy virtual machines, storage, networks, and templates. No user interaction is required, and the attack complexity is low. See the Apache CloudStack Security Advisory for authoritative technical details.

Detection Methods for CVE-2024-42062

Indicators of Compromise

Unexpected API calls signed with the root admin's API key originating from IPs previously associated with domain admin accounts.
CloudStack management server logs showing listUsers or getUserKeys calls issued by non-root admin accounts against out-of-scope domains.
Sudden creation, modification, or deletion of virtual machines, templates, or networks by administrative accounts outside their normal operational patterns.
Regeneration of API and secret keys that were not initiated by the legitimate account owner.

Detection Strategies

Audit CloudStack API access logs for cross-domain queries against user credential endpoints.
Correlate API key usage against expected source IP ranges and user-agent strings for each administrative account.
Baseline normal domain admin activity and alert on privilege-sensitive API calls such as account or user enumeration.

Monitoring Recommendations

Forward CloudStack management server and usage server logs to a centralized SIEM for continuous review.
Enable alerting on any use of root admin API keys from unexpected network locations or outside change windows.
Track the frequency of registerUserKeys and getUserKeys invocations and flag anomalies.

How to Mitigate CVE-2024-42062

Immediate Actions Required

Upgrade Apache CloudStack to version 4.18.2.3, 4.19.1.1, or later as directed by the Apache CloudStack Security Advisory.
Regenerate all account-user API and secret keys across every domain, including the root admin account.
Review recent domain admin activity for evidence of unauthorized credential queries or API key reuse.
Restrict domain admin account creation and enforce least-privilege role assignments.

Patch Information

Apache CloudStack 4.18.2.3 and 4.19.1.1 correct the authorization check so that domain admins cannot retrieve API and secret keys for accounts outside their domain scope. Additional details are available in the ShapeBlue Security Advisory and the Openwall OSS-Security notification.

Workarounds

Rotate all API and secret keys immediately, even if upgrades cannot be applied in the same maintenance window.
Temporarily reduce the number of domain admin accounts and audit their assigned domains.
Restrict network access to the CloudStack management API to trusted operator subnets while patching is planned.

bash

# Configuration example
# After upgrading, rotate API and secret keys for every account-user
# Example using the CloudStack CLI (cmk):
cmk list users listall=true | \
  jq -r '.user[] | .id' | \
  while read uid; do
    cmk register userkeys id="$uid"
  done