This vulnerability (CWE-77) in Apache CloudStack arises from improper neutralization of special elements in commands within the run and get diagnostics functionality for system VMs and virtual routers. An authenticated user with admin role permissions to call getDiagnosticsData or runDiagnostics APIs can execute arbitrary commands on the system VM or virtual router instances. Commands run with root privileges or at least as the diagnostics-process user, leading to full compromise of the affected instance. This can facilitate lateral movement within the CloudStack-managed environment and access to guest network traffic. The vulnerability affects Apache CloudStack versions >=4.20.0.0 <4.20.3.1 and >=4.21.0.0 <4.22.1.1. Users are advised to upgrade to 4.20.3.1 or 4.22.1.1 or later to remediate the issue.

Successful exploitation allows an authenticated admin user to execute arbitrary commands as root or diagnostics-process user on system VMs or virtual routers, resulting in full compromise of those instances. This can lead to unauthorized control over network traffic and potential lateral movement within the CloudStack infrastructure.

Upgrade affected Apache CloudStack installations to version 4.20.3.1 or 4.22.1.1 or later, which contain fixes for this vulnerability. No other mitigation or temporary workaround is specified. Since the APIs are restricted to admin role accounts by default, limiting admin access reduces exposure.