Alert! Hackers Exploiting Critical Vulnerability in VMware's Aria Operations Networks
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-20867 | Authentication Bypass in VMware Tools Lets Compromised ESXi Hosts Run Guest Operations VMware Tools, the agent installed inside guest virtual machines, fails to properly authenticate host-to-guest operations when they are issued from an ESXi host (CVE-2023-20867, CWE-287 improper authentication). An attacker who has already gained full (root) control of an ESXi host can invoke these operations, such as running commands or moving files inside guest VMs, and the guests' VMware Tools will accept them without valid authentication. This gives an attacker a foothold in guest VMs without guest credentials, affecting guest confidentiality and integrity. Any organization running VMware ESXi/vSphere with VMware Tools in its guests is affected, and the component is also shipped as open-vm-tools in Debian and Fedora. The flaw is confirmed exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2023-06-23 (EPSS 13.5%, 96th percentile), and China-linked APT UNC3886, whose 'Fire Ant' tooling targets ESXi and vCenter, has been reported using it alongside other VMware flaws. Do: Upgrade VMware Tools / open-vm-tools to the latest fixed release distributed by VMware, Debian, or Fedora per the vendor advisory, and inventory guests running outdated Tools. Because exploitation requires a fully compromised ESXi host, hunt for signs of host compromise (unexpected processes, modified VIBs, suspicious vCenter activity) and review guest VMs for unexplained command execution or persistence. Consistent with the KEV required action, prioritize patching, starting with internet-facing ESXi hosts and virtualization management infrastructure. | 3.9 | 14% | KEV |
| mass≈millions of guest VMs (VMware Tools is installed by default on nearly all VMware guests), though actual exploitability requires an already fully compromised… | |
| CVE-2023-20887 | Unauthenticated Command Injection RCE in VMware Aria Operations for Networks VMware Aria Operations for Networks (formerly vRealize Network Insight) contains a command injection flaw (CWE-77) that allows an attacker with network access to the appliance to run arbitrary operating-system commands. Because the attack requires no authentication, privileges, or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), any party able to reach the product's network interface can trigger it, gaining remote code execution with high impact on confidentiality, integrity, and availability. Any organization running the product is affected, with internet-facing deployments at the greatest risk. Exploitation is confirmed in the wild — CISA added the flaw to the KEV catalog on 2023-06-22, a public proof-of-concept exploit is available, and EPSS puts the 30-day exploitation probability at 98.3% (top percentile). Ransomware use is currently unknown. Do: Apply the vendor's patched update to all Aria Operations for Networks deployments as soon as possible — this is also CISA's required KEV action (apply updates per vendor instructions); verify the installed build against VMware's advisory for affected ranges. Until patching is complete, restrict network access to the appliance (firewall rules, VPN, or management-segment isolation), prioritizing any instance reachable from the internet since no authentication is required to exploit. Hunt for indicators of command injection exploitation, as in-the-wild exploitation has been confirmed. | 9.8 | 98% | KEV PoC |
| moderate≈10,000+ appliance deployments worldwide (low tens of thousands of appliance nodes); only a small fraction, likely hundreds to low thousands of instances, are… |
Full article323 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananJun 21, 2023Vulnerability / Network Security
VMware has flagged that a recently patched critical command injection vulnerability in Aria Operations for Networks (formerly vRealize Network Insight) has come under active exploitation in the wild.
The flaw, tracked as CVE-2023-20887, could allow a malicious actor with network access to the product to perform a command injection attack, resulting in remote code execution.
It impacts VMware Aria Operations Networks versions 6.x, with fixes released in versions 6.2, 6.3, 6.4, 6.5.1, 6.6, 6.7, 6.8, 6.9, and 6.10 on June 7, 2023.
Now according to an update shared by the virtualization services provider on June 20, 2023, the flaw has been weaponized in real-world attacks, although the exact specifics are unknown as yet.
"VMware has confirmed that exploitation of CVE-2023-20887 has occurred in the wild," the company noted.
Data gathered by threat intelligence firm GreyNoise shows active exploitation of the flaw from two different IP addresses located in the Netherlands starting June 13, 2023.
The development comes after Summoning Team researcher Sina Kheirkhah, who identified and reported the flaws, released a proof-of-concept (PoC) exploit for the bug.
"This vulnerability comprises a chain of two issues leading to remote code execution (RCE) that can be exploited by unauthenticated attackers," Kheirkhah said.
If anything, the speed at which either state actors or financially motivated groups turn around newly disclosed vulnerabilities and exploit them to their advantage continues to be a major threat for organizations across the world.
The disclosure also follows a report from Mandiant, which unearthed active exploitation of another flaw in VMware Tools (CVE-2023-20867) by a suspected Chinese actor dubbed UNC3886 to backdoor Windows and Linux hosts.
Users of Aria Operations for Networks are recommended to update to the latest version as soon as possible to mitigate potential risks.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2023/06/alert-hackers-exploiting-critical.html