From 2eb1d2e1071f6607479bf10e1f49b10da48eaf3c Mon Sep 17 00:00:00 2001 From: Maximand Date: Thu, 26 Oct 2023 10:57:55 +0200 Subject: [PATCH] casefile for divd-2023-00039 --- _cases/2023/DIVD-2023-00039.md | 56 ++++++++++++++++++++++++++++++++++ 1 file changed, 56 insertions(+) create mode 100644 _cases/2023/DIVD-2023-00039.md diff --git a/_cases/2023/DIVD-2023-00039.md b/_cases/2023/DIVD-2023-00039.md new file mode 100644 index 00000000..85b79db8 --- /dev/null +++ b/_cases/2023/DIVD-2023-00039.md @@ -0,0 +1,56 @@ +--- +layout: case +title: VMware vCenter Server RCE +excerpt: "VMware has released security updates for vCenter Server that could result in Remote Command Execution. " +author: Max van der Horst +lead: Max van der Horst +researchers: +- Stan Plasmeijer +- Victor Pasman +- Ralph Horn +- Max van der Horst +cves: +- CVE-2023-34048 +product: +- VMware vCenter Server +versions: +- All versions +recommendation: Update vCenter Server to the patched versions provided. These are 8.0U1d or 8.0U2, 6.7U3 and 6.5U3. +patch_status: patch unavailable +workaround: There is no workaround for this issue. +status : Open +start: 2023-10-25 +end: +timeline: +- start: 2023-10-25 + end: + event: "DIVD starts researching CVE-2023-34048." +- start: 2023-10-26 + end: + event: "DIVD starts scanning for vulnerable instances." + +# You can set IPs to n/a when this case isn't about IPs (e.g. stolen credentials) +--- +## Summary + +VMware issued security updates to fix a Remote Code Execution vulnerability in vCenter Server. The vulnerability has CVE ID CVE-2023-34048 and exists in all previous versions of vCenter server. Unauthenticated attackers are able to remotely exploit this vulnerability and could lead to complete takeover of the instance. + +## Recommendations + +Because there is no workaround available, the advice is to take VMware vCenter off the public internet or limit access by Access Control Lists and update your vCenter instance as soon as possible. + +## What we are doing + +DIVD is scanning for vulnerable instances by checking the standard VMware information endpoint. Owners of such systems will receive a notification with this casefile and remediation steps. + + +{% comment %} Leave this here, so we see a timeline {% endcomment %} +{% include timeline.html %} + + +## More information + +* [CVE-2023-34048](https://nvd.nist.gov/vuln/detail/CVE-2023-34048) +* [BleepingComputer](https://www.bleepingcomputer.com/news/security/vmware-fixes-critical-code-execution-flaw-in-vcenter-server/) +* [VMware Advisory](https://www.vmware.com/security/advisories/VMSA-2023-0023.html) +