### #VMwareVulnerabilities #CyberSecurity #RemoteCodeExecution
Summary: Broadcom has issued a warning about active exploitation of two critical vulnerabilities in VMware vCenter Server, one being a remote code execution flaw. Security researchers have highlighted the urgency for affected customers to apply the latest patches to mitigate these threats.
Threat Actor: UNC3886 | UNC3886
Victim: VMware vCenter Server | VMware vCenter Server
Key Point :
- Two vulnerabilities (CVE-2024-38812 and CVE-2024-38813) are being actively exploited, with one allowing remote code execution and the other enabling privilege escalation.
- Broadcom has released new security updates after the initial patch failed to fully address the RCE flaw, urging immediate application by administrators.
- Threat actors, including state-sponsored groups, have a history of targeting VMware vCenter vulnerabilities for malicious purposes.
Broadcom warned today that attackers are now exploiting two VMware vCenter Server vulnerabilities, one of which is a critical remote code execution flaw.
TZL security researchers reported the RCE vulnerability (CVE-2024-38812) during China’s 2024 Matrix Cup hacking contest. It is caused by a heap overflow weakness in the vCenter’s DCE/RPC protocol implementation and affects products containing vCenter, including VMware vSphere and VMware Cloud Foundation.
The other vCenter Server flaw now exploited in the wild (reported by the same researchers) is a privilege escalation flaw tracked as CVE-2024-38813 that enables attackers to escalate privileges to root with a specially crafted network packet.
“Updated advisory to note that VMware by Broadcom confirmed that exploitation has occurred in the wild for CVE-2024-38812 and CVE-2024-38813,” Broadcom said on Monday.
The company released security updates in September to fix both vulnerabilities. Still, roughly one month later, it updated the security advisory warning that the original CVE-2024-38812 patch hadn’t fully addressed the flaw and “strongly” encouraged admins to apply the new patches.
No workarounds are available for these security flaws, so impacted customers are advised to apply the latest updates immediately to block attacks actively exploiting them.
Broadcom has also released a supplemental advisory with additional information on deploying the security updates on vulnerable systems and known issues that could impact those who have already upgraded.
In June, the company fixed a similar vCenter Server RCE vulnerability (CVE-2024-37079) that attackers can also exploit via specially crafted packets.
Threat actors, including ransomware gangs and state-sponsored hacking groups, frequently target vulnerabilities in VMware vCenter. For instance, in January, Broadcom revealed that Chinese state hackers had been exploiting a critical vCenter Server vulnerability (CVE-2023-34048) as a zero-day since at least late 2021.
This threat group (tracked as UNC3886 by security firm Mandiant) abused the flaw to deploy VirtualPita and VirtualPie backdoors on ESXi hosts via maliciously crafted vSphere Installation Bundles (VIBs).