Critical OS Command Injection Vulnerability in Aviatrix Controllers

What changed

A significant vulnerability has been discovered in Aviatrix Controllers prior to versions 7.1.4191 and 7.2.4996. The flaw arises from improper handling of special elements in OS commands, which can be exploited by attackers.

This vulnerability enables unauthenticated users to send crafted shell metacharacters to specific API endpoints, potentially leading to arbitrary code execution.

Who is affected

Organizations using Aviatrix Controllers are at risk, particularly those operating on versions before the specified updates.

This vulnerability affects various deployments in cloud environments where Aviatrix solutions are utilized.

• Aviatrix Controller versions prior to 7.1.4191
• Aviatrix Controller versions in the 7.2.x series before 7.2.4996
• Cloud service providers leveraging Aviatrix for network management
• Enterprises using Aviatrix for multi-cloud networking solutions

What to do

It is imperative for affected organizations to upgrade their Aviatrix Controllers to the latest versions to mitigate this vulnerability. Regularly review security practices and ensure that all systems are updated promptly.

Additionally, consider implementing network segmentation and monitoring to detect any unauthorized access attempts.

• Upgrade to Aviatrix Controller version 7.1.4191 or later
• Upgrade to Aviatrix Controller version 7.2.4996 or later
• Conduct a security audit of existing cloud configurations
• Monitor API access logs for unusual activity