Unrestricted File Upload in Aviatrix Controller (CVE‑2021‑40870) Enables Remote Code Execution
What It Is
Aviatrix Controller permits an unauthenticated attacker to upload a file of a dangerous type and traverse directories. The flaw bypasses file‑type validation, allowing arbitrary code to be written to the filesystem and subsequently executed.
Exploitability
The vulnerability is rated High (CVSS ≈ 8.8). It can be triggered remotely without credentials. Proof‑of‑concept code has been published, but no large‑scale exploit campaigns have been observed to date.
Affected Products
- Vendor: Aviatrix
- Product: Aviatrix Controller (all supported versions prior to the vendor‑released fix)
Why It Matters for Compliance & Audit Readiness
Control‑assurance programs require evidence that third‑party cloud networking components are managed under a vetted vendor‑management framework. An unrestricted upload flaw undermines access‑control and change‑management controls, creating a gap in continuous monitoring and audit trails. Demonstrating that the vulnerability has been identified, patched, and that compensating controls (e.g., WAF rules, file‑type whitelisting) are in place satisfies audit inquiries around defensible evidence of due diligence and aligns with NIST CSF PR.IP‑1 (“A baseline configuration … is maintained and used to manage the system”).
Recommended Actions
- Inventory all Aviatrix Controller instances and verify version numbers.
- Apply the vendor‑released patch or upgrade to the latest supported release.
- Enforce strict file‑type validation and directory‑traversal mitigations at the application layer (e.g., WAF, API gateway).
- Enable logging of all file‑upload attempts and integrate alerts into a SIEM for continuous monitoring.
- Update vendor‑risk registers to reflect the remediation status and capture evidence for audit purposes.
Source: https://nvd.nist.gov/vuln/detail/CVE-2021-40870