CVE-2024-45462: Apache CloudStack Auth Bypass Vulnerability

CVE-2024-45462 Overview

CVE-2024-45462 is a session management flaw in the Apache CloudStack web interface. The logout operation fails to fully invalidate the user session on the backend. The session remains valid until it expires by time or until the backend service restarts. An attacker with access to the user's browser can reuse the unexpired session token to access resources owned by the previously logged-out account.

The issue affects Apache CloudStack from 4.15.1.0 through 4.18.2.3, and from 4.19.0.0 through 4.19.1.1. The Apache CloudStack project has released fixed versions 4.18.2.4 and 4.19.1.2. The weakness is categorized as [CWE-613] Insufficient Session Expiration.

Critical Impact
An attacker with local access to a user's browser can hijack a logged-out session to access tenant resources, virtual machines, and cloud infrastructure managed through CloudStack.

Affected Products

Apache CloudStack 4.15.1.0 through 4.18.2.3
Apache CloudStack 4.19.0.0 through 4.19.1.1
Fixed in Apache CloudStack 4.18.2.4 and 4.19.1.2

Discovery Timeline

2024-10-16 - CVE-2024-45462 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-45462

Vulnerability Analysis

Apache CloudStack is an open-source Infrastructure-as-a-Service (IaaS) platform used to deploy and manage large networks of virtual machines. The web interface authenticates administrators and tenants using server-side session tokens.

When a user clicks logout in the CloudStack web console, the frontend clears client-side state but the backend does not terminate the associated session. The session identifier remains valid on the server until its scheduled timeout elapses or the management service restarts. An adversary who obtains the session token — for example, by accessing a shared workstation, extracting a browser cookie, or reading a proxy log — can replay it to the CloudStack API and impersonate the logged-out user.

The impact extends across confidentiality and integrity of tenant workloads. A hijacked administrator session grants control over virtual machines, storage, and network configuration for the tenant scope of the affected account.

Root Cause

The root cause is missing server-side session invalidation on logout, aligned with [CWE-613] Insufficient Session Expiration. The logout endpoint does not remove the session record from the backend session store, so the token remains a valid credential until the timeout counter expires.

Attack Vector

Exploitation requires local access to a browser or session store where a CloudStack session was previously established, and some user interaction to reach the browser context. Once the token is recovered, the attacker sends authenticated API requests to CloudStack using the reused session, bypassing the expected logout boundary. No password, multi-factor prompt, or re-authentication is required for the replay.

The vulnerability mechanism is described in the Apache CloudStack Security Advisory and the Apache Mailing List Thread.

Detection Methods for CVE-2024-45462

Indicators of Compromise

CloudStack API calls issued from a session ID after the user submitted a logout event in the same session.
API activity originating from a source IP address or user-agent that differs from the one used to establish the session.
Reuse of the same JSESSIONID cookie across disparate client fingerprints within the session lifetime window.

Detection Strategies

Correlate CloudStack management server access logs with user-driven logout events to flag any post-logout use of the same session token.
Alert on CloudStack API requests where session age exceeds the expected interactive window or spans a suspicious geographic delta.
Baseline normal session duration per user role and identify outliers that persist beyond typical administrator activity.

Monitoring Recommendations

Ship CloudStack management server logs and audit events to a centralized SIEM for retention and correlation with endpoint activity.
Monitor authentication and session events for anomalous replay patterns, and review privileged API calls executed against tenant resources.
Track service restarts of the CloudStack management server, since restart is one of the two conditions that clears the stale sessions.

How to Mitigate CVE-2024-45462

Immediate Actions Required

Upgrade Apache CloudStack to version 4.18.2.4, 4.19.1.2, or later.
Restart the CloudStack management service after upgrade to force invalidation of any sessions issued by the vulnerable build.
Rotate administrator credentials and API keys for accounts that authenticated against affected versions from shared or untrusted workstations.

Patch Information

The Apache CloudStack project addressed the flaw in releases 4.18.2.4 and 4.19.1.2. Details of the fix and full release notes are available in the Apache CloudStack Security Advisory and the corresponding OpenWall OSS Security Discussion.

Workarounds

Reduce the CloudStack session timeout to the shortest interval acceptable for operations, limiting the replay window for stolen tokens.
Restrict access to the CloudStack web console to trusted networks or through a reverse proxy that enforces additional session controls.
Instruct users to close the browser fully after logout and avoid using shared or unmanaged devices to access the CloudStack UI until patched.

bash

# Verify installed CloudStack management server version
rpm -q cloudstack-management   # RHEL/CentOS
dpkg -l | grep cloudstack-management   # Debian/Ubuntu

# After upgrading, restart the service to invalidate legacy sessions
systemctl restart cloudstack-management