Exploit for OS Command Injection in Aviatrix Controller

CVE-2024-50603

githubexploit · 2025-01-08

Description

Exploit for OS command injection in Aviatrix Controller CVE-2024-50603 and nuclei proof of concept.

Entry point

Parametercloud_type · query param

Path/v1/api

Unauthenticated command injection via API endpoints: /v1/api using cloud_type (list_flightpath_destination_instances) or src_cloud_type (flightpath_connection_test).

Affected Aviatrix Controller versions

Aviatrix Controller< 7.1.4191, 7.2.4996

All known vulnerabilities by product

Aviatrix Controller

CVSS 10.0 for CVE-2024-50603

10.0

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:CHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

Working code

100%confidence this exploit runs

Based on 2 file(s) in the source

EPSS Score

98.5%higher than 99.9% of all CVEs

Updated 2026-06-18

Exploit Details

Modified:2025-08-29 16:34

Last Seen:2025-12-15 04:34

Reporter:newlinesec

Last commit:2025-01-08

Other exploits for CVE-2024-50603

Aviatrix Controller list_flightpath_destination_instances command injection

2025-02-04 SAINT CorporationSAINT

Aviatrix Controller list_flightpath_destination_instances command injection

2025-02-04 SAINT CorporationSAINT

Exploit for OS Command Injection in Aviatrix Controller

2025-01-12 th3gokulGITHUB

Exploit Code

README3 lines

## https://sploitus.com/exploit?id=51D93731-AA82-5D3A-A5E9-E66DB00B1FB3
# CVE-2024-50603
CVE-2024-50603-nuclei-poc

Exploit Code

Share

Share on social media: