+20,000 internet-exposed VMware ESXi instances vulnerable to CVE-2024
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-37085 | Authentication Bypass in VMware ESXi via AD Group Recreation VMware ESXi is vulnerable to an authentication bypass (CWE-305) when the host is configured to use Active Directory for user management. An attacker who has sufficient Active Directory permissions can delete the AD group tied to ESXi administration (typically the default 'ESXi Admins' group) and then re-create it, causing ESXi to treat the re-created group as the original administrator group. This grants the actor full access to the ESXi host without needing ESXi credentials themselves. Only ESXi hosts that were joined to and configured with Active Directory for user management are affected; hosts using local authentication are not. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-07-30 with known ransomware use, and EPSS assigns a high 26.8% probability of exploitation in the next 30 days (98th percentile). Do: Apply the security updates or mitigations published in the vendor's (VMware/Broadcom) advisory for your ESXi release, per the CISA KEV required action. As interim mitigation, protect the configured AD admin group (default 'ESXi Admins') from deletion or re-create it with the original identity, and restrict AD permissions that allow arbitrary group deletion. Since ransomware use is known, audit AD logs for deletion/re-creation of the 'ESXi Admins' group and verify integrity of any AD-joined ESXi hosts. | 7.2 | 27% | KEV ransomware |
| mass≈100,000+ ESXi hosts (tens of thousands are internet-exposed in public scans, and the installed base is far larger, though only AD-joined hosts are vulnerable) |
Full article499 words · extracted from securityaffairs.com · click to collapse
Shadowserver researchers reported that over 20,000 internet-exposed VMware ESXi instances are affected by the actively exploited flaw CVE-2024-37085.
Researchers at the Shadowserver Foundation reported that approximately 20,000 VMware ESXi servers exposed online appear impacted by the exploited vulnerability CVE-2024-37085.
— The Shadowserver Foundation (@Shadowserver) July 31, 2024We have started sharing exposed VMware ESXi vulnerable to CVE-2024-37085 (authentication bypass). While rated only CVSS 6.8 by Broadcom, this vuln has been reported by Microsoft as exploited in the wild by ransomware operators.
We see 20 275 instances vulnerable on 2024-07-30. pic.twitter.com/wTkqDSLQ38
Microsoft this week warned that multiple ransomware gangs are exploiting the recently patched vulnerability CVE-2024-37085 (CVSS score of 6.8) in VMware ESXi flaw.
“Microsoft researchers have uncovered a vulnerability in ESXi hypervisors being exploited by several ransomware operators to obtain full administrative permissions on domain-joined ESXi hypervisors.” warned Microsoft.
The flaw is an authentication bypass vulnerability in VMware ESXi.
“A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management by re-creating the configured AD group (‘ESXi Admins’ by default) after it was deleted from AD.” reads the advisory published by the virtualization giant.
The company released patches for security vulnerabilities affecting ESXi 8.0 and VMware Cloud Foundation 5.x. However, no patches are planned for the older versions, ESXi 7.0 and VMware Cloud Foundation 4.x. Users of the unsupported versions are recommended to upgrade to newer versions to receive security updates and support.
Microsoft reported that multiple financially motivated groups like Storm-0506, Storm-1175, and Octo Tempest have already exploited this vulnerability to deploy ransomware.
“Microsoft security researchers identified a new post-compromise technique utilized by ransomware operators like Storm-0506, Storm-1175, Octo Tempest, and Manatee Tempest in numerous attacks.” continues Microsoft. “In several cases, the use of this technique has led to Akira and Black Basta ransomware deployments. “
Shadowserver researchers observed 20 275 instances vulnerable to CVE-2024-37085 on 2024-07-30.
“VMware ESXi CVE-2024-37085 authentication bypass vulnerability. While only rated MEDIUM criticality (CVSS 6.8) by Broadcom, we consider the vulnerability much more serious as it is being exploited in the wild by ransomware actors. If you receive an alert for your instance, please check for compromise and update. This is a version based scan.” reads the report published by Shadowserver. “We do not check for workarounds or whether the ESXi hypervisor is domain joined, a condition of exploitability. Any report should be viewed as potentially vulnerable and to be verified by the recipient. Tagged as cve-2024-37085. [tagging first added 2024-07-30]”
However, some of the exposed instances may have been temporary secured through workarounds.
“For clarity: these are potentially vulnerable as this is a remote version check only for patch status. We do not have detection of any workarounds in place nor do we check whether other pre-conditions of exploitability exist (domain-joined ESXi hypervisors).” states Shadowserver.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, VMware ESXi)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/166432/hacking/vmware-esxi-cve-2024-37085-vulnerable-instances.html