VMware ESXi Authentication Bypass Vulnerability

CVE-2024-37085

7.2HIGH

Key Information

Vendor: VMware
Status: Vmware Esxi; Vmware Cloud Foundation
Vendor: CVE Published:; 25 June 2024

🥇 Trended No. 1📈 Trended📈 Score: 65,200💰 Ransomware👾 Exploit Exists🟡 Public PoC🦅 CISA Reported📰 News Worthy

What is CVE-2024-37085?

CVE-2024-37085 is a critical vulnerability in VMware ESXi, a widely used virtualization platform that allows users to run multiple virtual machines on a single physical server. This vulnerability arises from an authentication bypass issue, which permits a malicious actor with adequate Active Directory (AD) permissions to gain unauthorized access to an ESXi host configured for AD user management. If exploited, it can lead to significant security breaches, putting sensitive data and essential services at risk.

Technical Details

The vulnerability exists due to the ability for an attacker to recreate a deleted AD group, typically the 'ESXi Admins' group, that is responsible for managing permissions on the ESXi host. By leveraging sufficient AD permissions, the attacker can bypass authentication mechanisms and effectively assume control of the ESXi host without proper authorization, compromising the integrity and confidentiality of virtual machines running on that host. This adds complexity to the security environment as it intertwines with the configurations and management of Active Directory.

Impact of the Vulnerability

Unauthorized Access: Attackers can gain full administrative control over ESXi hosts, allowing them to manipulate virtual machines and disrupt services without detection.
Data Breach Risk: With administrative privileges, attackers could exfiltrate sensitive data stored within the virtual machines, leading to potential data loss, regulatory violations, and a reputational impact.
Service Disruption: The ability to control ESXi hosts can lead to service outages or interruptions, affecting business operations and availability, which can be devastating for organizations that rely on these virtualized environments for critical processes.

CISA Reported

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2024-37085 as being exploited and is known by the CISA as enabling ransomware campaigns.

The CISA's recommendation is: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Affected Version(s)

VMware Cloud Foundation 5.x

VMware Cloud Foundation 4.x

VMware ESXi 8.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-37085-RCE-POC
Created by Florian-Hoth