Apache CloudStack: metalink template registration gives a tenant root on the KVM hypervisor host

Impact

A tenant holding only the default User role can execute shell commands as root on the KVM host that runs other tenants' VMs. Registering a template with directDownload=true and a .metalink URL makes the management server fetch the metalink XML and hand the download to the KVM agent, and the inner URLs inside that XML are never re-checked against the scheme allowlist. The same path also gives server-side request forgery through the Secondary Storage VM, which retrieves internal targets and persists them as a template that can then be downloaded through normal APIs. This is cross-tenant root on shared compute reached through the public CloudStack API, so on a GPU cloud built on CloudStack it puts one tenant on the hypervisor underneath everyone else's accelerators.

Who can reach it

Any authenticated CloudStack account with the default User role, over the public API. No admin privilege, no operator interaction, no access to the management network required.

What to do

Upgrade to 4.20.3.1 or 4.22.1.1 or later; versions 4.14.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0 are affected. That means updating the management servers and the KVM agents and restarting those daemons - agent restarts are live-migration friendly but should still be staged per host. Until then, treat direct-download template registration as a privileged operation and restrict which accounts may register templates from URLs.

References