CVE-2025-59302: Apache CloudStack: Potential remote code execution on Javascript engine defined rules
In Apache CloudStack improper control of generation of code ('Code Injection') vulnerability is found in the following APIs which are accessible only to admins.
quotaTariffCreate quotaTariffUpdate createSecondaryStorageSelector updateSecondaryStorageSelector updateHost updateStorage
This issue affects Apache CloudStack: from 4.18.0 before 4.20.2, from 4.21.0 before 4.22.0. Users are recommended to upgrade to versions 4.20.2 or 4.22.0, which contain the fix.
The fix introduces a new global configuration flag, js.interpretation.enabled, allowing administrators to control the interpretation of JavaScript expressions in these APIs, thereby mitigating the code injection risk.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59302?
CVE-2025-59302 is classified as a critical vulnerability due to its potential for code injection in admin-accessible APIs.
How do I fix CVE-2025-59302?
To fix CVE-2025-59302, update Apache CloudStack to version 4.22.0 or later, or apply the necessary security patches provided by the Apache team.
What versions of Apache CloudStack are affected by CVE-2025-59302?
CVE-2025-59302 affects Apache CloudStack versions from 4.18.0 to 4.20.2 and the 4.21.0 version.
What APIs are impacted by CVE-2025-59302?
CVE-2025-59302 impacts the following APIs: quotaTariffCreate, quotaTariffUpdate, createSecondaryStorageSelector, and updateSecondaryStorageSelector.
Who is at risk from CVE-2025-59302?
Admin users of Apache CloudStack are at risk from CVE-2025-59302 due to improper control allowing code generation through vulnerable APIs.