Critical · published January 8, 2025
CVSS calls it critical at 10.0. It is confirmed in active exploitation. It sits in the 99.9th percentile for exploit probability.
🚨 A crafty attacker could easily execute arbitrary code just by sending a specially crafted API request! 🔥 Think of it like a delivery driver who sneaks in a decoy package labeled 'urgent documents' to access the secure area of a building — once inside, they can cause chaos! An unauthenticated attacker could remotely slip malicious commands into your system, potentially gaining full control. This could lead to data theft, disruption of services, or worse, a complete takeover of your cloud infrastructure!
Think of it like a delivery driver who sneaks in a decoy package labeled 'urgent documents' to access the secure area of a building — once inside, they can cause chaos! This vulnerability arises from improper neutralization of special elements in an OS command, allowing attackers to exploit API endpoints like /v1/api with shell metacharacters, effectively bypassing authentication and executing arbitrary code.
An unauthenticated attacker could remotely slip malicious commands into your system, potentially gaining full control. This could lead to data theft, disruption of services, or worse, a complete takeover of your cloud infrastructure! Upgrade Aviatrix Controller to version 7.1.4191 or 7.2.4996 immediately to mitigate the risk. Additionally, review access controls and monitor API calls for any suspicious activity. 🛡️ You’ve got this! Together, we can tighten up security and keep those bad actors at bay! 💪✨