Wiz Research Identifies Exploitation in the Wild of Aviatrix Controller RCE (CVE-2024-50603)

The Wiz Incident Response team is currently responding to multiple incidents involving CVE-2024-50603, an Aviatrix Controller unauthenticated RCE vulnerability, that can lead to privileges escalation in the AWS control plane. Organizations should patch urgently.

Updated on 2025-01-19 to include additional investigation findings related toSliverand Mirai infections.

CVE-2024-50603 is a critical code execution vulnerability impacting Aviatrix Controller with the maximum CVSS score of 10.0. This command injection flaw allows unauthenticated attackers to execute arbitrary commands on the system remotely. The vulnerability stems from the improper neutralization of user-supplied input, and has been addressed in patched versions7.1.4191and7.2.4996.

When deployed in AWS cloud environments, Aviatrix Controller allows privilege escalation by default, making exploitation of this vulnerability a high-impact risk. A simple proof-of-concept exploithas been published, and Wiz Research has already observed exploitation in the wild resulting in cryptojacking and backdoor deployment. For these reasons, it is highly recommended to upgrade Aviatrix Controller to the patched versions, conduct forensic investigation on the devices, and search for lateral movement attempts to the cloud control plane.

The vulnerability resides in the improper handling of user-supplied parameters in the Aviatrix Controller's API, implemented in PHP. Specifically, the API endpointslist_flightpath_destination_instancesandflightpath_connection_testincorporate parameters likecloud_typeandsrc_cloud_typeinto command strings without proper sanitization. This flaw allows attackers to inject malicious OS commands, allowing arbitrary commands to be executed on the controller by an unauthenticated user.

Based on our data, around 3% of cloud enterprise environments have Aviatrix Controller deployed. However, our data shows that in 65% of such environments, the virtual machine hosting Aviatrix Controller has a lateral movement path to administrative cloud control plane permissions.

We estimate that the reason for this is that by default, Aviatrix Controller is granted high IAM privileges in AWS cloud environments through the roles it can assume, which must be allowed to perform IAM actions in order to function properly (according to thevendor’s documentation).

This lateral movement potential makes Aviatrix Controller a prime target for threat actors aiming to move laterally and escalate their privileges in the cloud environment once gaining initial access to the controller via exploitation of this RCE.

The vulnerability was published on 2025-01-07, alongside ablogpostby the researcher who discovered the vulnerability (Jakub Korepta of SecuRing), explaining in detail how it can be exploited. A proof-of-concept exploit based on the blogpost wasmade publicly availableby a security researcher (newlinesec) on 2025-01-08. Immediately following the publication of the exploit, Wiz Research identified evidence of successful exploitation of this vulnerability across several cloud environments.

In all observed instances, the infected machines were publicly exposed, confirmed as vulnerable to CVE-2024-50603, and not vulnerable to CVE-2021-40870 (the last known RCE vulnerability affecting Aviatrix Controller), which leads us to conclude with high confidence that the attackers gained access to these machines via exploitation of the recent RCE. All observed malware was first deployed between 2025-01-07 and 2025-01-10, with exploitation surging following the publication of aNuclei template.

Our investigation of these instances has shown that the threat actors exploiting this vulnerability are abusing their access to mine cryptocurrency using XMRig and deploy Sliver backdoors, presumably for persistence purposes (to avoid losing access if the infected machine is patched).

Additionally, we have observed multiple (failed) attempts to infect Aviatrix Controller instances with Mirai via exploitation of CVE-2024-50603. Furthermore, at least one of the actors deploying Sliver backdoors has been conducting their operations from the IP address 172.104.60[.]176, but this islikely a shared proxy serverand therefore not strictly useful as an IOC.

While we have yet to see direct evidence of cloud lateral movement, we do believe it likely that threat actors are utilizing the vulnerability to enumerate the cloud permissions of the host and then pivot to exfiltrating data from the victims' cloud environments.

This vulnerability impacts Aviatrix Controller in versions before7.1.4191and versions7.2.xbefore7.2.4996.

It is recommended to upgrade Aviatrix Controller to the patched version (7.2.4996), and if possible, we also suggest implementing network restrictions to prevent public access to Aviatrix Controller.

Wiz customers can use the pre-built query and advisory in theWiz Threat Centerto search for publicly exposed as well as vulnerable instances of Aviatrix Controller in their environment.

Whether or not your environment is already patched, it is critical to hunt for any evidence of prior compromise to assure no backdoors were left behind, and that no lateral movement to the cloud control plane has occurred.

Security teams can utilize Wiz to proactively hunt for evidence of compromise using the following methods:

Review the threat page for any threats associated with compute resources hosting Aviatrix Controller [Wiz Defend customers only].

Use the Security Graph to search for malware findings on compute resources hosting Aviatrix technologies.

Use the Cloud Events Explorer to search for network-based IOCs in any IP address field (see Appendix).

Use the Cloud Events Explorer to search for any cloud provider security alerts where the principal is the compute resource hosting Aviatrix Controller.

Use the Cloud Events Explorer to search for AWS CloudTrail events where the “Acting As” field is set to one of thedefault Aviatrix roles(aviatrix-role-ec2oraviatrix-role-app), and the principal IP address hasn't been previously observed, or is performing abnormal API calls.

Use the Cloud Events Explorer to review network logs for any abnormal DNS requests or outgoing IP connections from Aviatrix Controller devices.

For effective threat hunting, make sure control, security, and network logs are properly integrated with Wiz.

Aviatrix advisory

Proof of Concept exploit

SecuRing blogpost by Jakub Korepta

The HackerNews article

See how Wiz protects your cloud from code to runtime

Fazal Merchant joins our leadership team as we look to what lies ahead.

Detect and mitigate CVE-2025-0282, a critical RCE vulnerability in Ivanti Connect Secure and CVE-2025-0283, exploited as 0day vulnerabilities in the wild. Organizations should patch urgently.

Wizards share some of the cloud security trends to look out for in 2025.

Get a personalized demo

©2026Wiz, Inc.

StatusPrivacy PolicyTerms of UseModern Slavery StatementCookie Settings