VMware Cloud Director up to 9.1.0.3/9.5.0.5/9.7.0.4/10.0.0.1 injection

Summaryinfo

A vulnerability was found in VMware Cloud Director up to 9.1.0.3/9.5.0.5/9.7.0.4/10.0.0.1. It has been declared as critical. This affects an unknown part. Executing a manipulation can lead to injection. This vulnerability is handled as CVE-2020-3956. The attack can be executed remotely. Additionally, an exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in VMware Cloud Director up to 9.1.0.3/9.5.0.5/9.7.0.4/10.0.0.1 (Cloud Software). This vulnerability affects some unknown processing. The manipulation with an unknown input leads to a injection vulnerability. The CWE definition for the vulnerability is CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

VMware Cloud Director 10.0.x before 10.0.0.2, 9.7.0.x before 9.7.0.5, 9.5.0.x before 9.5.0.6, and 9.1.0.x before 9.1.0.4 do not properly handle input leading to a code injection vulnerability. An authenticated actor may be able to send malicious traffic to VMware Cloud Director which may lead to arbitrary remote code execution. This vulnerability can be exploited through the HTML5- and Flex-based UIs, the API Explorer interface and API access.

The weakness was released 05/20/2020. This vulnerability was named CVE-2020-3956 since 12/30/2019. The attack can be initiated remotely. Required for exploitation is a single authentication. Technical details are unknown but a public exploit is available. The MITRE ATT&CK project declares the attack technique as T1055.

A public exploit has been developed by Tomas Melicher in Python and been published 4 days after the advisory. It is possible to download the exploit at exploit-db.com. It is declared as functional. As 0-day the estimated underground price was around $5k-$25k.

Upgrading to version 9.1.0.4, 9.5.0.6, 9.7.0.5 or 10.0.0.2 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Exploit-DB (48549). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Cloud Software

Vendor

• VMware

Name

• Cloud Director

Version

• 9.1.0.0
• 9.1.0.1
• 9.1.0.2
• 9.1.0.3
• 9.5.0.0
• 9.5.0.1
• 9.5.0.2
• 9.5.0.3
• 9.5.0.4
• 9.5.0.5
• 9.7.0.0
• 9.7.0.1
• 9.7.0.2
• 9.7.0.3
• 9.7.0.4
• 10.0.0.0
• 10.0.0.1

License

• commercial

Website

• Vendor: https://www.vmware.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion