Cloud in the crosshairs: exposing vulnerabilities in web-based management interfaces of open-source IaaS platforms

Abstract

The security of open-source cloud platforms is paramount, given their widespread adoption in modern business operations. This study conducts a large-scale empirical security analysis of the web-based management interfaces of ten widely used open-source Infrastructure-as-a-Service (IaaS) platforms. Using a black-box penetration testing methodology that combines automated scanning with Burp Suite and its security extensions with systematic manual analysis, we identified a total of 16 vulnerabilities spanning nine classes, including high-severity flaws that enable account takeover. Our findings, which culminated in the assignment of six new Common Vulnerabilities and Exposures (CVE) IDs, provide concrete, empirically validated examples of how server misconfigurations and flawed authentication logic manifest in the exposed management interfaces of mainstream open-source IaaS platforms, including mis-issued API tokens, time-based user enumeration, and host-header–driven misrouting. Specifically, the identified vulnerabilities stem from improper authentication, insufficient input validation, and server misconfigurations. In addition to a responsible vulnerability disclosure process, this work provides practical hardening recommendations to mitigate the identified weaknesses.