Apache CloudStack Access Control Vulnerability in listTemplates and listIsos APIs

An access control vulnerability has been identified in Apache CloudStack, specifically in the listTemplates and listIsos APIs. This issue allows a malicious Domain Admin or Resource Admin to gain unauthorized visibility into templates and ISOs under the ROOT domain. By specifying the 'domainid' parameter along with 'filter=self' or 'filter=selfexecutable' values, the attacker can enumerate and extract metadata of templates and ISOs from unrelated domains, violating isolation boundaries and potentially exposing sensitive internal configuration details. This vulnerability affects Apache CloudStack versions 4.0.0 through 4.19.2.0 and 4.10.0.0 through 4.20.0.0.

Impact

Exploitation of this vulnerability allows for unauthorized access to and enumeration of templates and ISOs across different domains, potentially exposing sensitive metadata and internal configuration details.

Remediation

Users are advised to upgrade to Apache CloudStack versions 4.19.3.0 or 4.20.1.0, both of which address this vulnerability. Instructions for upgrading are available in the release notes for these versions.