Vulnerability Card

A critical vulnerability identified as CVE-2024-37085 affects VMware ESXi and VMware Cloud Foundation. The flaw is located in the Active Directory integration component of these products. Exploiting this vulnerability allows attackers to gain full administrative access to ESXi hosts configured to use Active Directory for user management by manipulating the "ESX Admins" group. This vulnerability has been actively exploited in the wild, particularly by ransomware groups, to escalate privileges and encrypt downstream file systems.

• Name: VMware ESXi Authentication Bypass Vulnerability
• Identifiers: CVE-2024-37085
• Severity Level: Medium
• CVSS Score: 6.8
• Network Requirements for Exploitation: NETWORK
• Difficulty of Exploitation: LOW
• Required Privileges: HIGH
• User Interaction: REQUIRED
• Impacted Vendor: VMware
• Affected Product: VMware ESXi and VMware Cloud Foundation
• Scope of Impact: Unknown
• Classification: Other - This classification indicates that the vulnerability does not fall under common categories such as RCE, XSS, or SQL Injection but is still significant due to its potential impact on system security.
• Tags:
  • Critical Vulnerability: This tag indicates the significant impact of the vulnerability, particularly its active exploitation in the wild and association with high-severity consequences like ransomware attacks.

Vulnerability Details

The vulnerability principle of CVE-2024-37085 lies in an authentication bypass issue in VMware ESXi hypervisors that are integrated with Active Directory for user management. The vulnerability allows attackers to gain full administrative access to ESXi hosts by manipulating the Active Directory group configurations associated with the ESXi hosts. Specifically, when an ESXi hypervisor is joined to an Active Directory domain, it incorrectly grants full administrative privileges to any members of a domain group named "ESX Admins," even if the group did not originally exist. Attackers can exploit this flaw by creating or renaming a group to "ESX Admins" and adding themselves or other users to this group, thereby escalating their privileges to full administrative control over the ESXi hypervisor and the virtual machines it hosts. This vulnerability has been exploited in zero-day attacks by ransomware groups to obtain administrative permissions and encrypt downstream file systems .

Risks:

• Unauthorized Access: Exploitation allows attackers to gain full administrative control over ESXi hypervisors, leading to unauthorized access to sensitive virtual machines and their data .
• Data Encryption: Attackers can leverage this access to encrypt the entire ESXi file system, disrupting all hosted virtual machines and making data inaccessible unless a ransom is paid .
• Service Disruption: Full administrative access enables attackers to halt or disrupt critical services running on virtual machines, causing extensive downtime and operational impact .
• Credential Theft: The attackers can steal domain administrator credentials and move laterally across the network, further compromising additional systems and data .
• Persistence Mechanisms: Attackers might install persistence mechanisms to maintain long-term access to compromised systems, complicating remediation efforts .

Affected Manufacturers and Products: This vulnerability affects VMware's ESXi and Cloud Foundation products:

• VMware ESXi 8.0 (fixed in ESXi80U3-24022510)
• VMware ESXi 7.0 (no patch planned)
• VMware Cloud Foundation 5.x (fixed in 5.2)
• VMware Cloud Foundation 4.x (no patch planned) .

Proof of Concept

Vulnerability Exploitation Method

The exploitation of CVE-2024-37085 involves manipulating the Active Directory (AD) integration in VMware ESXi hypervisors. Attackers can exploit this vulnerability by creating or renaming groups within AD to escalate privileges and gain administrative control over ESXi hypervisors. Here are the steps involved:

1. Creating the "ESX Admins" Group:

   • Attackers create a group named "ESX Admins" in the AD domain.
   • They add themselves or another user to this group.
   • ESXi hypervisors treat members of "ESX Admins" as having full administrative access by default.

2. Renaming an Existing Group:

   • If attackers have access to rename groups, they can rename any existing group to "ESX Admins."
   • Adding a user to this renamed group or using an existing group member grants administrative privileges on the ESXi hypervisor.

3. Maintaining Privileges:

   • Even if network administrators assign other groups for ESXi management, the administrative privileges for "ESX Admins" are not immediately revoked.
   • Attackers can continue to abuse these privileges until the group is completely removed or the settings are properly configured.

Vulnerability POC

• Proof of Concept Code:

  • The exploitation involves specific commands to manipulate the AD group settings.

• Command Lines:

  net group "ESX Admins" /domain /add
  net group "ESX Admins" username /domain /add
  

• URLs to POC Code:

  • Broadcom Security Advisory
  • Rapid7 AttackerKB Assessment

Exploitation

The vulnerability CVE-2024-37085 in VMware ESXi has been actively exploited by multiple ransomware groups. This vulnerability, stemming from an authentication bypass in Active Directory integration, allows attackers to gain full administrative control over domain-joined ESXi hypervisors. The exploitation method typically involves creating or renaming a domain group to "ESX Admins," which is then automatically granted full administrative access by the ESXi hypervisor. This vulnerability has been leveraged to escalate privileges and carry out extensive damage on the network by encrypting file systems of the hypervisors and the virtual machines they host .

Exploitation timeline:

• 2024-07-29: "VMware ESXi CVE-2024-37085 Targeted in Ransomware Campaigns" — Microsoft published a detailed threat intelligence blog on the exploitation of CVE-2024-37085 in zero-day attacks by ransomware groups, leading to full administrative control over ESXi hypervisors .
• 2024-07-28: "VMware ESXi Hypervisor Vulnerability (CVE-2024-37085) Exploited" — Microsoft highlighted the ongoing active exploitation of this critical vulnerability by ransomware groups. The blog detailed the methods of exploitation and the significant impact on network operations .
• 2024-06-25: "CVE-2024-37085 Detail - NVD" — Broadcom released an advisory noting the fix for this vulnerability and provided mitigation steps .

Exploiting Gang Information:

Remediation

The official fix for CVE-2024-37085 has been released. Broadcom issued an advisory on June 25, 2024, addressing the vulnerability in VMware ESXi hypervisors. This fix was part of a broader update that also addressed other vulnerabilities .

The method of fixing CVE-2024-37085 involves updating to the latest patched version of VMware ESXi. Specifically, administrators should update to ESXi 8.0 U3 or VMware Cloud Foundation 5.x. For those who cannot immediately apply the update, Broadcom has provided a workaround that includes modifying several advanced ESXi settings to enhance security. The workaround highlights that, in versions prior to ESXi 8.0 U3, certain default settings are insecure. The fix and workaround details can be found in Broadcom's advisory.

In summary, here are the patch links in a table format:

Intels

Links