CVE-2024-29006: Apache CloudStack: x-forwarded-for HTTP header parsed by default
By default the CloudStack management server honours the x-forwarded-for HTTP header and logs it as the source IP of an API request. This could lead to authentication bypass and other operational problems should an attacker decide to spoof their IP address this way. Users are recommended to upgrade to CloudStack version 4.18.1.1 or 4.19.0.1, which fixes this issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-29006?
CVE-2024-29006 has been assessed as a medium severity vulnerability that can lead to authentication bypass.
How do I fix CVE-2024-29006?
To fix CVE-2024-29006, ensure that the CloudStack management server does not trust the x-forwarded-for header unless it is coming from a trusted proxy.
What versions of Apache CloudStack are affected by CVE-2024-29006?
CVE-2024-29006 affects Apache CloudStack versions up to 4.18.1.1 and 4.19.0.1.
Can CVE-2024-29006 lead to data breaches?
Yes, CVE-2024-29006 can potentially allow unauthorized access to sensitive data by exploiting the authentication bypass.
Is there a patch available for CVE-2024-29006?
Currently, users should upgrade to a patched version of Apache CloudStack that addresses CVE-2024-29006.