Merge pull request #682 from DIVD-NL/divd-2023-00039

casefile for divd-2023-00039

_cases/2023/DIVD-2023-00039.md

@@ -0,0 +1,56 @@
+---
+layout: case
+title: VMware vCenter Server RCE
+excerpt: "VMware has released security updates for vCenter Server that could result in Remote Command Execution. "
+author: Max van der Horst
+lead:  Max van der Horst
+researchers:
+- Stan Plasmeijer
+- Victor Pasman
+- Ralph Horn
+- Max van der Horst
+cves:
+- CVE-2023-34048
+product: 
+- VMware vCenter Server
+versions: 
+- All versions
+recommendation: Update vCenter Server to the patched versions provided. These are 8.0U1d or 8.0U2, 6.7U3 and 6.5U3. 
+patch_status: patch unavailable
+workaround: There is no workaround for this issue.
+status : Open
+start: 2023-10-25
+end: 
+timeline:
+- start: 2023-10-25
+  end:
+  event: "DIVD starts researching CVE-2023-34048."
+- start: 2023-10-26
+  end:
+  event: "DIVD starts scanning for vulnerable instances."
+
+# You can set IPs to n/a when this case isn't about IPs (e.g. stolen credentials)
+---
+## Summary
+
+VMware issued security updates to fix a Remote Code Execution vulnerability in vCenter Server. The vulnerability has CVE ID CVE-2023-34048 and exists in all previous versions of vCenter server. Unauthenticated attackers are able to remotely exploit this vulnerability and could lead to complete takeover of the instance.
+
+## Recommendations
+
+Because there is no workaround available, the advice is to take VMware vCenter off the public internet or limit access by Access Control Lists and update your vCenter instance as soon as possible. 
+
+## What we are doing
+
+DIVD is scanning for vulnerable instances by checking the standard VMware information endpoint. Owners of such systems will receive a notification with this casefile and remediation steps.
+
+
+{% comment %}  Leave this here, so we see a timeline {% endcomment %}
+{% include timeline.html %}
+
+
+## More information
+
+* [CVE-2023-34048](https://nvd.nist.gov/vuln/detail/CVE-2023-34048)
+* [BleepingComputer](https://www.bleepingcomputer.com/news/security/vmware-fixes-critical-code-execution-flaw-in-vcenter-server/)
+* [VMware Advisory](https://www.vmware.com/security/advisories/VMSA-2023-0023.html)
+