Critical Code Injection Vulnerability Patched in Apache CloudStack (CVE-2025-59302)

Published: 2025-11-27T12:15:47.410

Overview

A critical code injection vulnerability, identified as CVE-2025-59302, has been discovered in Apache CloudStack. This vulnerability affects specific APIs accessible only to administrators, potentially allowing for unauthorized code execution within the CloudStack environment. This article provides a detailed analysis of the vulnerability, its potential impact, and the necessary steps for mitigation.

Technical Details

CVE-2025-59302 stems from improper control of code generation (‘Code Injection’) in the following Apache CloudStack APIs:

• quotaTariffCreate
• quotaTariffUpdate
• createSecondaryStorageSelector
• updateSecondaryStorageSelector
• updateHost
• updateStorage

The vulnerability affects Apache CloudStack versions:

• From 4.18.0 before 4.20.2
• From 4.21.0 before 4.22.0

CVSS Analysis

The CVSS score for this vulnerability is currently N/A. However, given the potential for code injection and the administrative access required to exploit it, it’s crucial to prioritize patching. A high CVSS score is anticipated upon full assessment.

Possible Impact

Successful exploitation of CVE-2025-59302 could allow an attacker with administrative privileges to inject and execute arbitrary code within the Apache CloudStack environment. This could lead to:

• Complete compromise of the CloudStack management plane.
• Data breaches and exfiltration.
• Denial of service.
• Lateral movement to other systems within the infrastructure.

Mitigation and Patch Steps

Users are strongly advised to upgrade to the patched versions of Apache CloudStack:

• Upgrade to version 4.20.2 or later.
• Upgrade to version 4.22.0 or later.

The fix introduces a new global configuration flag, js.interpretation.enabled. This flag allows administrators to control the interpretation of JavaScript expressions within the affected APIs, effectively mitigating the code injection risk. It is recommended to carefully review the configuration options and enable or disable JavaScript interpretation based on your organization’s security policies and requirements.

References