VMware fixes critical flaws in Aria Operations for Networks (CVE-2023-20887)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-31702 | vRealize Network Insight (vRNI) contains a command injection vulnerability present in the vRNI REST API. vRealize Network Insight (vRNI) contains a command injection vulnerability present in the vRNI REST API. A malicious actor with network access to the vRNI REST API can execute commands without authentication. NVD description · AI analysis pending | 9.8 | 2% |
| — | ||
| CVE-2023-20887 | Unauthenticated Command Injection RCE in VMware Aria Operations for Networks VMware Aria Operations for Networks (formerly vRealize Network Insight) contains a command injection flaw (CWE-77) that allows an attacker with network access to the appliance to run arbitrary operating-system commands. Because the attack requires no authentication, privileges, or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), any party able to reach the product's network interface can trigger it, gaining remote code execution with high impact on confidentiality, integrity, and availability. Any organization running the product is affected, with internet-facing deployments at the greatest risk. Exploitation is confirmed in the wild — CISA added the flaw to the KEV catalog on 2023-06-22, a public proof-of-concept exploit is available, and EPSS puts the 30-day exploitation probability at 98.3% (top percentile). Ransomware use is currently unknown. Do: Apply the vendor's patched update to all Aria Operations for Networks deployments as soon as possible — this is also CISA's required KEV action (apply updates per vendor instructions); verify the installed build against VMware's advisory for affected ranges. Until patching is complete, restrict network access to the appliance (firewall rules, VPN, or management-segment isolation), prioritizing any instance reachable from the internet since no authentication is required to exploit. Hunt for indicators of command injection exploitation, as in-the-wild exploitation has been confirmed. | 9.8 | 98% | KEV PoC |
| moderate≈10,000+ appliance deployments worldwide (low tens of thousands of appliance nodes); only a small fraction, likely hundreds to low thousands of instances, are… | |
| CVE-2023-20888 +1 in the same advisory: …20889 | Aria Operations for Networks contains an authenticated deserialization vulnerability. Aria Operations for Networks contains an authenticated deserialization vulnerability. A malicious actor with network access to VMware Aria Operations for Networks and valid 'member' role credentials may be able to perform a deserialization attack resulting in remote code execution. NVD description · AI analysis pending | 8.8 group max | 82% |
| — |
Full article306 words · extracted from helpnetsecurity.com · click to collapse
VMware has fixed two critical (CVE-2023-20887, CVE-2023-20888) and one important vulnerability (CVE-2023-20889) in Aria Operations for Networks (formerly vRealize Network Insight), its popular enterprise network monitoring tool.
About the vulnerabilities (CVE-2023-20887, CVE-2023-20888,CVE-2023-20889)
CVE-2023-20887 is a pre-authentication command injection vulnerability that may allow a malicious actor with network access to VMware Aria Operations for Networks to perform a command injection attack and execute code remotely.
“According to a tweet by researcher Y4er, CVE-2023-20887 is reportedly a patch bypass for CVE-2022-31702, another critical command injection vulnerability in vRNI that was patched by VMware in December 2022,” Tenable’s Scott Caveza revealed.
CVE-2023-20888 is an authenticated deserialization vulnerability that may allow a malicious actor with network access to VMware Aria Operations for Networks and valid “member” role credentials to execute code through a deserialization attack.
CVE-2023-20889 is an information disclosure vulnerability that could allow a malicious actor who has network access to VMware Aria Operations for Networks to perform a command injection attack that could result in information disclosure.
The three vulnerabilties have been discovered by researcher Sina Kheirkhah of Summoning Team and reported to VMware via Trend Micro’s Zero Day Initiative (ZDI). But CVE-2023-20887 was also independently discovered and reported – obviously a bit earlier – to the ZDI by an anonymous researcher, who received credit for the RCE flaw.
Kheirkhah has released technical details and a PoC exploit for CVE-2023-20887. Currently, there is no mention or evidence of the flaw being exploited in the wild.
Remediation
Multiple versions of VMware Aria Operations for Networks, namely
Versions 6.2, 6.3, 6.4, 6.5.1, 6.6, 6.7, 6.8, 6.9, and 6.10 of VMware Aria Operations for Networks are affected by these vulnerabilities.
Since there are no workarounds, VMware recommends updating to a fixed version.
UPDATE (June 21, 2023, 05:50 a.m. ET):
CVE-2023-20887 has been spotted being exploited in the wild.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2023/06/15/cve-2023-20887-poc-exploit/