VMware Releases Patch for Critical RCE Flaw in Cloud Foundation Platform
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-39144 | Deserialization RCE in XStream XML Library Affecting Multiple Vendors CVE-2021-39144 is a remote code execution vulnerability in XStream, a widely used Java library that serializes objects to XML and back, caused by unsafe deserialization of a manipulated input stream (CWE-502, CWE-94, CWE-306). An attacker with sufficient rights to feed crafted input into an application running an affected XStream version can trigger arbitrary type instantiation and execute commands on the host, with high impact to confidentiality, integrity and availability (CVSS 3.1: 8.5, scope changed). Only deployments relying on XStream's default blacklist configuration are affected; users who configured XStream's security framework with a whitelist limited to the minimal required types are not affected, and XStream 1.4.18 removed the vulnerable default blacklist behavior. The library is embedded in many downstream products in the data, including Debian Linux and Fedora packages, NetApp SnapManager, and numerous Oracle Communications, Commerce and Retail products, and it was exploited in VMware Cloud Foundation and NSX Manager. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2023-03-10, is being actively exploited in the wild per current headlines, and EPSS assigns a 98.1% probability of exploitation within 30 days. Do: Upgrade XStream to 1.4.18 or later, or configure its security framework with a whitelist limited to the minimal required types; apply vendor-supplied updates for VMware Cloud Foundation/NSX Manager, Oracle, NetApp, Debian and Fedora per the CISA KEV required action. Prioritize internet-exposed VMware NSX Manager and Cloud Foundation deployments, which are being actively exploited, and audit any applications that pass untrusted XML input into XStream. | 8.5 | 98% | KEV PoC ×2 |
| masson the order of 100,000+ deployments (bundled across Oracle, NetApp, VMware, Debian and Fedora product lines) | |
| CVE-2022-31678 | VMware Cloud Foundation (NSX-V) contains an XML External Entity (XXE) vulnerability. VMware Cloud Foundation (NSX-V) contains an XML External Entity (XXE) vulnerability. On VCF 3.x instances with NSX-V deployed, this may allow a user to exploit this issue leading to a denial-of-service condition or unintended information disclosure. NVD description · AI analysis pending | 9.1 | 9% |
| — |
Full article214 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananOct 26, 2022
VMware on Tuesday shipped security updates to address a critical security flaw in its VMware Cloud Foundation product.
Tracked as CVE-2021-39144, the issue has been rated 9.8 out of 10 on the CVSS vulnerability scoring system, and relates to a remote code execution vulnerability via XStream open source library.
"Due to an unauthenticated endpoint that leverages XStream for input serialization in VMware Cloud Foundation (NSX-V), a malicious actor can get remote code execution in the context of 'root' on the appliance," the company said in an advisory.
In light of the severity of the flaw and its relatively low bar for exploitation, the Palo Alto-based virtualization services provider has also made available a patch for end-of-life products.
Also addressed by VMware as part of the update is CVE-2022-31678 (CVSS score: 5.3), an XML External Entity (XXE) vulnerability that could be exploited to result in a denial-of-service (DoS) condition or unauthorized information disclosure.
Security researchers Sina Kheirkhah and Steven Seeley of Source Incite have been credited with reporting both the flaws.
Users of VMware Cloud Foundation are advised to apply the patches to mitigate potential threats.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2022/10/vmware-releases-patch-for-critical-rce.html