VMware fixes critical vulnerability in Aria Operations for Networks (CVE-2023-34039)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-20887 | Unauthenticated Command Injection RCE in VMware Aria Operations for Networks VMware Aria Operations for Networks (formerly vRealize Network Insight) contains a command injection flaw (CWE-77) that allows an attacker with network access to the appliance to run arbitrary operating-system commands. Because the attack requires no authentication, privileges, or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), any party able to reach the product's network interface can trigger it, gaining remote code execution with high impact on confidentiality, integrity, and availability. Any organization running the product is affected, with internet-facing deployments at the greatest risk. Exploitation is confirmed in the wild — CISA added the flaw to the KEV catalog on 2023-06-22, a public proof-of-concept exploit is available, and EPSS puts the 30-day exploitation probability at 98.3% (top percentile). Ransomware use is currently unknown. Do: Apply the vendor's patched update to all Aria Operations for Networks deployments as soon as possible — this is also CISA's required KEV action (apply updates per vendor instructions); verify the installed build against VMware's advisory for affected ranges. Until patching is complete, restrict network access to the appliance (firewall rules, VPN, or management-segment isolation), prioritizing any instance reachable from the internet since no authentication is required to exploit. Hunt for indicators of command injection exploitation, as in-the-wild exploitation has been confirmed. | 9.8 | 98% | KEV PoC |
| moderate≈10,000+ appliance deployments worldwide (low tens of thousands of appliance nodes); only a small fraction, likely hundreds to low thousands of instances, are… | |
| CVE-2023-34039 +1 in the same advisory: …20890 | Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key generation. Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key generation. A malicious actor with network access to Aria Operations for Networks could bypass SSH authentication to gain access to the Aria Operations for Networks CLI. NVD description · AI analysis pending | 9.8 group max | 67% | PoC |
| — |
Full article278 words · extracted from helpnetsecurity.com · click to collapse
VMware has patched one critical (CVE-2023-34039) and one high-severity vulnerability (CVE-2023-20890) in Aria Operations for Networks, its popular enterprise network monitoring tool.
About the vulnerabilities (CVE-2023-34039, CVE-2023-20890)
CVE-2023-34039 is a network bypass vulnerability arising as a result of a lack of unique cryptographic key generation. It could allow an attacker with network access to Aria Operations for Networks to bypass SSH authentication to gain access to the Aria Operations for Networks command-line interface (CLI).
CVE-2023-20890 is an arbitrary file write vulnerability that could allow an authenticated attacker with administrative access to VMware Aria Operations for Networks to write files to arbitrary locations resulting in remote code execution.
The first vulnerability has been reported by Harsh Jaiswal and Rahul Maini at ProjectDiscovery Research and the second by Sina Kheirkhah of Summoning Team.
There are no indications that the vulnerabilities have been exploited in the wild.
Aria Operations for Networks versions 6.2 / 6.3 / 6.4 / 6.5.1 / 6.6 / 6.7 / 6.8 / 6.9 / 6.10 are impacted and, since there are no workarounds, users are urged to update to version 6.11.0 as soon as possible.
Aria Operations for Networks under attack
In mid-June 2023, VMware has fixed three vulnerabilities in VMware Aria Operations for Networks, one of which was being exploited in the wild (CVE-2023-20887).
CVE-2023-20887 is a pre-authentication command injection vulnerability that could allow an attacker with network access to VMware Aria Operations for Networks to perform a command injection attack and remotely execute code.
Attempts to exploit the flaw started two days after a PoC exploit was published.
UPDATE (September 2, 2023, 05:35 a.m. ET):
Vulnerability researcher Sina Kheirkhah has released a PoC for CVE-2023-34039.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2023/08/30/cve-2023-34039/