CISA Adds Additional VMware Security Flaw to Known Exploited Vulnerabilities Catalog

CVE-2021-39144 – VMware Cloud Foundation XStream Remote Code Execution Vulnerability

The Cybersecurity and Infrastructure Security Agency (CISA) has added another VMware vulnerability (CVE-2021-39144) to their growing list of vulnerabilities that they have observed threat actors exploiting in the wild. Exploitation only requires network access to the NSX-v Manager appliance, and successful exploitation will give root privileges (full control) of the NSX-v Manager. This exploit is lower complexity with available POC code, and vulnerable systems only need to be network accessible to any compromised machines, or web accessible, with no additional requirements such as valid credentials.

All versions of VMware NSX Data Center for vSphere (NSX-v) Manager 6.4.14 are affected by the vulnerability. Because these are observed being actively exploited, it is important to ensure that relevant VMware products are fully patched. Additional information is available in the VMware article linked below. Proof of concept (POC) code is currently available, giving both security professionals and threat actors easy methods to find vulnerable systems. The NIST link below has references to available exploit code.

CVE-2021-39144 Mitigation

• If leveraging VMware Cloud Foundation, ensure that it is fully patched.
• Proper documentation of critical and sensitive infrastructure products to quickly identify potentially vulnerable systems.
• Network segmentation and limited accessibility to VMware/critical infrastructure should be enforced and periodically reviewed.

References

• https://www.cisa.gov/news-events/alerts/2023/03/10/cisa-adds-two-known-exploited-vulnerabilities-catalog
  
• https://www.bleepingcomputer.com/news/security/cisa-warns-of-critical-vmware-rce-flaw-exploited-in-attacks
  
• https://www.vmware.com/security/advisories/VMSA-2022-0027.html
  
• https://nvd.nist.gov/vuln/detail/CVE-2021-39144

Disclaimer

The information provided in this article is provided “as-is.” It is not finally evaluated intelligence and should be considered raw information that is provided for strictly situational awareness, given what is known at this time.