CVE-2025-30675: Apache CloudStack Information Disclosure

CVE-2025-30675 Overview

CVE-2025-30675 is an access control vulnerability in Apache CloudStack affecting the listTemplates and listIsos APIs. A malicious Domain Admin or Resource Admin can supply the domainid parameter along with filter=self or filter=selfexecutable values to gain unauthorized visibility into templates and ISOs under the ROOT domain. The flaw enables enumeration and metadata extraction of assets belonging to unrelated domains, violating tenant isolation boundaries in multi-tenant cloud deployments. Affected users should upgrade to Apache CloudStack 4.19.3.0 or 4.20.1.0. The issue is classified under [CWE-200] Information Exposure.

Critical Impact
Authenticated Domain or Resource Admins can enumerate templates and ISOs across tenant boundaries, exposing internal configuration details from unrelated domains.

Affected Products

Apache CloudStack versions prior to 4.19.3.0
Apache CloudStack 4.20.x versions prior to 4.20.1.0
Multi-tenant CloudStack deployments with delegated Domain or Resource Admin roles

Discovery Timeline

2025-06-11 - CVE-2025-30675 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30675

Vulnerability Analysis

Apache CloudStack uses a hierarchical domain model where the ROOT domain sits at the top and child domains inherit scoped permissions. The listTemplates and listIsos APIs are designed to return only assets a caller is authorized to view based on domain scope. The vulnerability arises because these APIs accept a caller-supplied domainid parameter without enforcing that the requested domain is within the caller's authorized scope.

When a Domain Admin or Resource Admin supplies domainid with the filters filter=self or filter=selfexecutable, the resolver defaults to the ROOT domain instead of restricting the query to the caller's own domain subtree. This crosses tenant boundaries and returns metadata for templates and ISOs owned by unrelated tenants.

Root Cause

The root cause is improper domain resolution logic in the template and ISO listing code paths. Domain resolution defaulted to ROOT rather than strictly binding to the caller's scope. The fix ensures domain resolution adheres to the caller's authorized scope, preventing scope escalation through a supplied domainid parameter.

Attack Vector

Exploitation requires an authenticated Domain Admin or Resource Admin account and network access to the CloudStack management API. The attacker issues an authenticated API call to listTemplates or listIsos with the domainid parameter and one of the vulnerable filter values (self or selfexecutable). No user interaction is required, and the request executes over standard CloudStack API endpoints.

No public proof-of-concept has been published. The vulnerability is documented in the Apache CloudStack CVE Advisory and the ShapeBlue Security Advisory.

Detection Methods for CVE-2025-30675

Indicators of Compromise

CloudStack API audit log entries showing listTemplates or listIsos calls containing a domainid parameter combined with filter=self or filter=selfexecutable originating from Domain Admin or Resource Admin accounts.
API responses returning template or ISO metadata for domains outside the caller's authorized subtree.
Unusual enumeration patterns from a single admin account touching multiple unrelated domain identifiers within a short interval.

Detection Strategies

Review CloudStack management server logs and API access logs for the vulnerable parameter combinations and correlate with the caller's domain scope.
Baseline normal API usage per admin account and alert on cross-domain access patterns that were not previously observed.
Compare the domainid supplied in each API call against the caller's assigned domain hierarchy to identify scope violations.

Monitoring Recommendations

Forward CloudStack API and audit logs to a centralized SIEM for correlation and long-term retention.
Alert on any use of the affected APIs by non-ROOT admins that specifies a domainid outside their own domain subtree.
Monitor privileged account activity for enumeration spikes against template and ISO endpoints following the disclosure date.

How to Mitigate CVE-2025-30675

Immediate Actions Required

Upgrade Apache CloudStack to version 4.19.3.0 or 4.20.1.0 as recommended by the Apache CloudStack project.
Audit existing Domain Admin and Resource Admin accounts and reduce entitlements where administrative delegation is not required.
Review historical API logs for prior exploitation attempts targeting listTemplates and listIsos with the vulnerable parameter combinations.

Patch Information

Apache CloudStack fixed the vulnerability in versions 4.19.3.0 and 4.20.1.0 by ensuring domain resolution in listTemplates and listIsos strictly adheres to the caller's scope rather than defaulting to the ROOT domain. Patch details are published in the Apache CloudStack CVE Advisory and referenced in the Apache Mailing List Thread.

Workarounds

Restrict network access to the CloudStack management API to trusted administrative networks only.
Limit the number of accounts granted Domain Admin or Resource Admin roles until patching is completed.
Implement API gateway or reverse proxy rules that inspect and reject listTemplates or listIsos requests where the domainid parameter falls outside the caller's authorized scope.

bash

# Upgrade Apache CloudStack management server to a fixed release
# Debian/Ubuntu example
sudo systemctl stop cloudstack-management
sudo apt-get update
sudo apt-get install cloudstack-management=4.20.1.0
sudo systemctl start cloudstack-management