CVE-2025-69233 — Denial of Service

title: Apache CloudStack Resource Allocation Bypass Attempt — CVE-2025-69233
id: scw-2026-05-08-ai-1
status: experimental
level: high
description: |
  This rule detects attempts to exploit CVE-2025-69233 in Apache CloudStack. The vulnerability allows authenticated users to bypass resource allocation limits due to race conditions. The detection looks for API calls to '/client/api' using the POST method, specifically targeting parameters related to resource counts and limits, which are indicative of an attempt to exploit this race condition and exceed allocation limits.
author: SCW Feed Engine (AI-generated)
date: 2026-05-08
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2025-69233/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/client/api'
      cs-method:
          - 'POST'
      cs-uri-query|contains:
          - 'resourceCount'
      cs-uri-query|contains:
          - 'resourceLimit'
      cs-uri-query|contains:
          - 'exceed'
      condition: cs-uri AND cs-method AND cs-uri-query
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse