This vulnerability involves improper neutralization of special elements used in OS commands (CWE-78) and SSRF (CWE-918) in Apache CloudStack. An authenticated tenant can exploit the metalink mirror URL resolution process by registering a template with a malicious metalink file. The Secondary Storage VM fetches and stores this file, which contains internal targets. When a VM template is registered with directDownload=true and a metalink URL, the management server fetches the metalink XML and instructs the KVM agent to download inner URLs without validating them against an allowed scheme list. This flaw enables an authenticated user with the default User role to execute arbitrary shell commands as root on the KVM hypervisor host, leading to cross-tenant root compromise. The affected versions are from 4.14.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. The vendor recommends upgrading to 4.20.3.1 or 4.22.1.1 or later to remediate the issue.

An authenticated tenant with default User role privileges can achieve remote code execution as root on the KVM hypervisor host that runs other tenants' virtual machines. This results in cross-tenant compromise of the underlying compute infrastructure via the public CloudStack API. The vulnerability also enables server-side request forgery through the metalink mirror URL resolution process, potentially exposing internal network resources. The impact is severe due to the ability to execute arbitrary commands with root privileges on the hypervisor.

Users should upgrade Apache CloudStack to version 4.20.3.1 or 4.22.1.1 or later, where this vulnerability is fixed. No official patch or temporary workaround details are provided in the advisory. Until upgraded, restrict authenticated tenant capabilities and monitor for suspicious template registrations involving metalink files. Patch status is confirmed by vendor recommendation to upgrade to these fixed versions.