CVE-2024-37085

Published Jun 25, 2024

Last updated a year ago

VMware ESXi

VDI

Overview

AI description

Automated description summarized from trusted sources.

CVE-2024-37085 is an authentication bypass vulnerability affecting VMware ESXi. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management. This can be achieved by re-creating the configured AD group (named 'ESXi Admins' by default) after it has been deleted from AD. Successful exploitation allows an attacker who has already gained limited system rights on a targeted server to escalate their privileges and gain full administrative control of the ESXi hypervisor. With this level of access, an attacker can manipulate the hypervisor's settings, control the guest operating systems, and potentially encrypt the file system.

Description: VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management https://blogs.vmware.com/vsphere/2012/09/joining-vsphere-hosts-to-active-directory.html by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.
Source: security@vmware.com
NVD status: Analyzed
Products: cloud_foundation, esxi

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.2
Impact score: 5.9
Exploitability score: 1.2
Vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Known exploits

Data from CISA

Vulnerability name: VMware ESXi Authentication Bypass Vulnerability
Exploit added on: Jul 30, 2024
Exploit action due: Aug 20, 2024
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Weaknesses

nvd@nist.gov: CWE-287
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-305

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "7FA8DFE6-9C74-4711-A8AF-3B170876A1F9",
            "versionEndExcluding": "5.2",
            "versionStartIncluding": "4.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:7.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "48D2E2D5-A0B8-4AF1-BF4A-30154F754C94",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:8.0:-:*:*:*:*:*:*",
            "matchCriteriaId": "7A1A402A-9262-4B97-A0B7-E5AE045E394D",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:8.0:a:*:*:*:*:*:*",
            "matchCriteriaId": "FE44B379-9943-4DD1-8514-26F87482AFA8",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:8.0:b:*:*:*:*:*:*",
            "matchCriteriaId": "2A797377-8945-4D75-AA68-A768855E5842",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:8.0:c:*:*:*:*:*:*",
            "matchCriteriaId": "79D84D76-54BE-49E9-905C-7D65B4B42D68",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:8.0:update_1:*:*:*:*:*:*",
            "matchCriteriaId": "2F8767F7-7C3D-457D-9EAC-E8A30796F751",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:8.0:update_1a:*:*:*:*:*:*",
            "matchCriteriaId": "29AF8474-2D7A-4C5A-82B9-7A873AD90C2E",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:8.0:update_1c:*:*:*:*:*:*",
            "matchCriteriaId": "7781A2CA-D927-48CD-9932-AE42B7BA1EFE",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:8.0:update_1d:*:*:*:*:*:*",
            "matchCriteriaId": "18FD08C9-5895-4BF4-BBE0-C2DDA5F6B836",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:8.0:update_2:*:*:*:*:*:*",
            "matchCriteriaId": "360C1B71-5360-4379-B0DE-63BB8F5E6DA2",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:8.0:update_2b:*:*:*:*:*:*",
            "matchCriteriaId": "B16ED7C1-9881-452A-8BE0-EDDEAEFE3D7B",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:vmware:esxi:8.0:update_2c:*:*:*:*:*:*",
            "matchCriteriaId": "ED92209F-FBD6-43F9-9A15-3842B139FCC9",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.