Broadcom VMware Hypervisor Vulnerability
CVE: CVE-2024-37085
What Is Vulnerable?
- Broadcom VMware ESXi
- VMware Cloud Foundation
The following VMWare products and versions are vulnerable to CVE-2024-37085:
- VMware ESXi 8.0 (fixed in ESXi80U3-24022510)
- VMware ESXi 7.0 (no patch planned)
- VMware Cloud Foundation 5.x (fixed in 5.2)
- VMware Cloud Foundation 4.x (no patch planned)
What is Happening?
A vulnerability has been found in domain-joined ESXi Hypervisors which provides a domain group's users with full administrative access to the Hypervisor without proper validation.
Researchers have found that when VMware ESXi hypervisors are joined to an Active Directory domain all members of the domain group are by default given full administrative access if the group is labelled "ESXi Admins".
This group doesn't exist by default and the hypervisor doesn't validate when the server is joined to the domain for its existence either.
Malicious actors are using access to a privileged account to create the domain group and add users to the ESXi Admin group to gain full administrative access to the Hypervisor.
Key Facts
- There is evidence of this vulnerability has been exploited in many Ransomware attacks.
- This isn't used as an initial point of entry for malicious attackers as they require access to a privileged account to make the domain group changes.
- Updates to remediate the vulnerability have been issued by VMware for some versions.
What you can do?
- Apply the security patches provided by VMware for ESXi and VMware Cloud Foundation for affected versions that have a planned patch
- VMware ESXi 7.0 and VMware Cloud Foundation 4.x don't have patches so settings changes are required to prevent exploitation. Broadcom has provided information on how to harden the device. Broadcom recommends, if possible, to update your hypervisor to a patched version - knowledge.broadcom.com
- Administrators who are unable to update should implement workaround recommendations in the interim.
Additionally, you can assess your domain groups for group name "ESXi Admins" and remove the group if not created for legitimate purposes.
Look for new (suspicious) users being created, or other configuration keys being tampered with.
Cythera is actively monitoring for this activity for managed detection and response clients
Cythera is committed to protecting our customers from cyber threats and ensuring their business continuity. If you have any questions or concerns about this or any other cybersecurity issue, please contact us
