VMware ESXi auth bypass zero-day exploited by ransomware operators (CVE-2024-37085)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-37085 | Authentication Bypass in VMware ESXi via AD Group Recreation VMware ESXi is vulnerable to an authentication bypass (CWE-305) when the host is configured to use Active Directory for user management. An attacker who has sufficient Active Directory permissions can delete the AD group tied to ESXi administration (typically the default 'ESXi Admins' group) and then re-create it, causing ESXi to treat the re-created group as the original administrator group. This grants the actor full access to the ESXi host without needing ESXi credentials themselves. Only ESXi hosts that were joined to and configured with Active Directory for user management are affected; hosts using local authentication are not. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-07-30 with known ransomware use, and EPSS assigns a high 26.8% probability of exploitation in the next 30 days (98th percentile). Do: Apply the security updates or mitigations published in the vendor's (VMware/Broadcom) advisory for your ESXi release, per the CISA KEV required action. As interim mitigation, protect the configured AD admin group (default 'ESXi Admins') from deletion or re-create it with the original identity, and restrict AD permissions that allow arbitrary group deletion. Since ransomware use is known, audit AD logs for deletion/re-creation of the 'ESXi Admins' group and verify integrity of any AD-joined ESXi hosts. | 7.2 | 27% | KEV ransomware |
| mass≈100,000+ ESXi hosts (tens of thousands are internet-exposed in public scans, and the installed base is far larger, though only AD-joined hosts are vulnerable) |
Full article518 words · extracted from helpnetsecurity.com · click to collapse
Ransomware operators have been leveraging CVE-2024-37085, an authentication bypass vulnerability affecting Active Directory domain-joined VMware ESXi hypervisors, to gain full administrative access to them and encrypt their file system.
VMware owner Broadcom has released a fix for CVE-2024-37085 on June 25, 2024 and credited Microsoft’s researchers for flagging it, but did not mention that the vulnerability – at that time, a zero-day – was under active exploitation.
Attackers exploiting CVE-2024-37085
“ESXi is a bare-metal hypervisor that is installed directly onto a physical server and provides direct access and control of underlying resources. ESXi hypervisors host virtual machines that may include critical servers in a network,” Microsoft’s threat analysts explained.
Ransomware operators have been using custom Linux versions of the Akira, Black Basta, Babuk, Lockbit, and other encryptors to encrypt VMware ESXi virtual machines, but leveraging ESXi vulnerabilities such as CVE-2024-37085 means easy encryption of multiple virtual machines (VMs) in one fell swoop.
According to Microsoft’s analysts, ransomware operators like Storm-0506, Storm-1175, Manatee Tempest, and Octo Tempest have been exploiting CVE-2024-37085 after gaining access to AD domain controllers by compromising credentials of domain administrators.
They would then create a group named “ESX Admins” in the domain and add a user to it, which automatically conferred to that user (i.e., the threat actor) full administrative access on the ESXi hypervisor.
“This group is not a built-in group in Active Directory and does not exist by default. ESXi hypervisors do not validate that such a group exists when the server is joined to a domain and still treats any members of a group with this name with full administrative access, even if the group did not originally exist. Additionally, the membership in the group is determined by name and not by security identifier (SID),” Microsoft’s researchers noted.
They subsequently also found that the same thing can be achieved by renaming any group in the domain to “ESX Admins” and adding a user to the group or using an existing group member.
What to do?
Full administrative access to an ESXi hypervisors means that before encrypting the file system, attackers can also access the hosted VMs and exfiltrate data from them.
CVE-2024-37085 has been fixed in ESXi 8.0 Update 3 and VMware Cloud Foundation 5.2. It won’t be fixed in ESXi 7.0 and VMware Cloud Foundation v4.x, but a workaround is available.
Admins are advised to upgrade their installations as soon as possible and check for suspicious modifications to the ESX Admins group (or its unsanctioned creation).
UPDATE (July 30, 2024, 09:40 a.m. ET):
“The premise of the vulnerability is that domain-joined ESXi will automatically check for a certain Active Directory group. If the group name exists, all members of that group will be granted admin privileges over the ESXi server,” Rapid7 vulnerability researcher Ryan Emmons further explained.
This was a documented feature / default configuration that admins were instructed to keep in mind and work around, and the risk this issue posed was publicly documented years ago.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2024/07/30/cve-2024-37085-exploited/