CVE-2024-45387

An attacker with an account holding one of the following roles: 'admin', 'federation', 'operations', 'portal' or 'steering' can send a specially crafted HTTP PUT request to Traffic Ops. Improper input validation (CWE-89) and insufficient access control (CWE-285) allow injection of arbitrary SQL code, which is executed directly on the database. The attack does not require interaction from another user and can be conducted remotely over the network.

An attacker can read, modify, or delete any data in the Traffic Ops database, leading to complete breach of confidentiality, integrity, and availability of the CDN management system. The scope of the attack extends beyond the application context itself (Scope: Changed), meaning potential impact on dependent infrastructure.

Apache Traffic Control should be updated to version 8.0.2, which contains a patch eliminating the vulnerability. If immediate update is not possible, it is recommended to restrict network access to the Traffic Ops interface to trusted hosts only and audit accounts holding the following roles: 'admin', 'federation', 'operations', 'portal' and 'steering'.

Apache Traffic Control in versions 8.0.0 and 8.0.1 (Traffic Ops component)