{
    "file_item": {
        "filepath": "security-advisories",
        "filename": "CERT-EU-SA2022-076.pdf"
    },
    "title": "Critical Vulnerability in VMware Cloud Foundation",
    "serial_number": "2022-076",
    "publish_date": "31-10-2022 09:20:00",
    "description": "On October 25, 2022, VMWare released a new version of Cloud Foundation (NSX-V) fixing a critical Remote Code Execution vulnerability. VMware has confirmed that exploit code leveraging \"CVE-2021-39144\" against impacted products has been published. It is highly recommended applying the last version.",
    "url_title": "2022-076",
    "content_markdown": "---\ntitle: 'Critical Vulnerability in VMware Cloud Foundation'\nversion: '1.0'\nnumber: '2022-076'\noriginal_date: 'October 25, 2022'\ndate: 'October 31, 2022'\n---\n\n_History:_\n\n* _31/10/2022 --- v1.0 -- Initial publication_\n  \n# Summary\n\nOn October 25, 2022, VMWare released a new version of Cloud Foundation (NSX-V) fixing a critical Remote Code Execution vulnerability [1]. VMware has confirmed that exploit code leveraging `CVE-2021-39144` against impacted products has been published [2]. It is highly recommended applying the last version.\n\n# Technical Details\n\nThe vulnerability, identified by `CVE-2021-39144`, with a CVSS score of 9.8 out of 10, is due to an unauthenticated endpoint that leverages XStream for input serialization in VMware Cloud Foundation (NSX-V). By exploiting this vulnerability, an unauthenticated attacker could achieve remote code execution in the context of the `root` user on the affected server.\n\n# Affected Products\n\n* All versions for VMware NSX Data Center for vSphere (NSX-V) prior to NSX-V 6.4.14 appliances [3]\n* All the VMware Cloud Foundation(VCF) 3.x versions\n\n# Recommendations\n\nCERT-EU highly recommends applying the latest version or the workaround provided by VMWare.\n\n# References\n\n[1] <https://www.vmware.com/security/advisories/VMSA-2022-0027.html>\n\n[2] <https://srcincite.io/blog/2022/10/25/eat-what-you-kill-pre-authenticated-rce-in-vmware-nsx-manager.html>\n\n[3] <https://kb.vmware.com/s/article/89809>\n",
    "content_html": "<p><em>History:</em></p><ul><li><em>31/10/2022 --- v1.0 -- Initial publication</em></li></ul><h2 id=\"summary\">Summary</h2><p>On October 25, 2022, VMWare released a new version of Cloud Foundation (NSX-V) fixing a critical Remote Code Execution vulnerability [1]. VMware has confirmed that exploit code leveraging <code>CVE-2021-39144</code> against impacted products has been published [2]. It is highly recommended applying the last version.</p><h2 id=\"technical-details\">Technical Details</h2><p>The vulnerability, identified by <code>CVE-2021-39144</code>, with a CVSS score of 9.8 out of 10, is due to an unauthenticated endpoint that leverages XStream for input serialization in VMware Cloud Foundation (NSX-V). By exploiting this vulnerability, an unauthenticated attacker could achieve remote code execution in the context of the <code>root</code> user on the affected server.</p><h2 id=\"affected-products\">Affected Products</h2><ul><li>All versions for VMware NSX Data Center for vSphere (NSX-V) prior to NSX-V 6.4.14 appliances [3]</li><li>All the VMware Cloud Foundation(VCF) 3.x versions</li></ul><h2 id=\"recommendations\">Recommendations</h2><p>CERT-EU highly recommends applying the latest version or the workaround provided by VMWare.</p><h2 id=\"references\">References</h2><p>[1] <a rel=\"noopener\" target=\"_blank\" href=\"https://www.vmware.com/security/advisories/VMSA-2022-0027.html\">https://www.vmware.com/security/advisories/VMSA-2022-0027.html</a></p><p>[2] <a rel=\"noopener\" target=\"_blank\" href=\"https://srcincite.io/blog/2022/10/25/eat-what-you-kill-pre-authenticated-rce-in-vmware-nsx-manager.html\">https://srcincite.io/blog/2022/10/25/eat-what-you-kill-pre-authenticated-rce-in-vmware-nsx-manager.html</a></p><p>[3] <a rel=\"noopener\" target=\"_blank\" href=\"https://kb.vmware.com/s/article/89809\">https://kb.vmware.com/s/article/89809</a></p>",
    "licence": {
        "title": "Creative Commons Attribution 4.0 International (CC-BY 4.0)",
        "link": "https://creativecommons.org/licenses/by/4.0/",
        "restrictions": "https://cert.europa.eu/legal-notice",
        "author": "The Cybersecurity Service for the Union institutions, bodies, offices and agencies"
    }
}