More

    Exploits for Citrix and VMware Vulnerabilities Made Available for PoC

    VMware Issues Warning on New Vulnerability

    VMware, a leader in virtualization services, has warned its customers about a proof-of-concept (PoC) exploit. This exploit targets a recently patched flaw in Aria Operations for Logs. The vulnerability, known as CVE-2023-34051, boasts a CVSS score of 8.1. It’s a high-severity flaw. It allows authentication bypass, which could lead to remote code execution. On October 19, 2023, VMware released an advisory about this. The advisory describes how malicious actors can inject files without authentication. These files can compromise the operating system of impacted appliances. James Horseman from Horizon3.ai and the Randori Attack Team found and reported this flaw. Furthermore, Horizon3.ai has showcased a PoC for this flaw. This prompted VMware to update its statements.

    Past and Present Vulnerabilities

    It’s crucial to understand that CVE-2023-34051 acts as a bypass for critical flaws. VMware addressed these flaws in January 2023. Those flaws also exposed users to remote code execution. Horseman emphasized how easy attackers can discover this patch bypass. He also stressed the significance of layered defense. He pointed out that an official patch might not always seal a vulnerability completely.

    Citrix’s New Advisory and Other Developments

    In related news, Citrix has advised its customers to apply fixes for another severe flaw, CVE-2023-4966. This flaw affects NetScaler ADC and NetScaler Gateway. With a CVSS score of 9.4, attackers are actively exploiting this vulnerability. Citrix Bleed, a PoC exploit for it, is now available. This is likely to intensify exploitation attempts. Dylan Pindur, an Assetnote researcher, identified the vulnerability’s root cause. He attributed it to a misunderstanding of the snprintf function, leading to a buffer over-read.

    The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recognized the active exploitation of CVE-2023-4966. They have added it to the Known Exploited Vulnerabilities (KEV) catalog. Hence, U.S. federal agencies must install the newest patches by November 8, 2023. Meanwhile, SolarWinds has updated three critical flaws in Access Rights Manager. Attackers can exploit these to execute code with SYSTEM privileges.

    Latest articles

    Related articles