Two critical vulnerabilities in Aviatrix Controller allowed attackers to bypass authentication and execute remote code with root privileges. This potentially compromised entire cloud infrastructures, granting attackers centralized control over cloud gateways and APIs. Successful exploitation could lead to a complete cloud environment takeover, affecting multiple cloud providers and regions.

Aviatrix, a provider of cloud networking services, experienced a critical vulnerability in their Aviatrix Controller product, identified as CVE-2024-50603. This flaw was exploited by malicious actors to orchestrate backdoor and cryptocurrency mining operations. The exploitation led to unauthorized command execution and potential privilege escalation within AWS cloud environments. Given that Aviatrix Controllers are deployed in many cloud enterprise settings, the impact of this security breach is considerable. The attackers employed XMRig for cryptojacking activities and deployed Sliver backdoors for persistence, with a real possibility of cloud lateral movement and data exfiltration.