{"uuid": "763e0ca9-7383-4620-b57d-d3a74eda15ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-34051", "type": "seen", "source": "https://t.me/hacking_Attack/124202", "content": "Black Hat Ethical Hacking\nVMware Security Alert: Proof-of-Concept Exploit Code Threatens Authentication Bypass Flaw\n\nVMware Security Alert: Proof-of-Concept Exploit Code Threatens Authentication Bypass Flaw\nPost Views: 20 Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2023/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nVMware has issued a warning to its customers regarding a significant threat. Proof-of-concept (PoC) exploit code is now circulating for a critical authentication bypass flaw found in vRealize Log Insight, which has since been rebranded as VMware Aria Operations for Logs.\n\nVMware took immediate action to update its advisory, confirming the availability of the exploit code for CVE-2023-34051. This particular vulnerability presents a serious concern, as it could potentially allow unauthenticated attackers to execute code remotely with root-level permissions, under specific conditions.\n\nThe successful exploitation of this flaw relies on a series of factors. Specifically, the attacker must compromise a host within the targeted environment. This compromised host must also have the necessary permissions to add an extra interface or a static IP address, further emphasizing the importance of robust security practices and access controls.\n\nThe discovery of this flaw can be attributed to the diligent work of security researchers from Horizon3, who have conducted a detailed root cause analysis. Their findings, which were published on a recent Friday, provide additional insights into how CVE-2023-34051 can be leveraged to gain remote code execution privileges with root access. Furthermore, Horizon3\u2019s security team has also released a PoC exploit, along with a list of indicators of compromise (IOCs) that network defenders can employ to identify any attempts at exploitation within their own environments.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses\nThe PoC exploit, as described by the Horizon3 Attack Team, relies on a combination of IP address spoofing and various Thrift RPC endpoints to achieve an arbitrary file write. Notably, the default configuration of this vulnerability involves the creation of a cron job to facilitate the generation of a reverse shell. To adapt this to specific environments, it is recommended to modify the payload file accordingly.\n\nIt\u2019s essential to highlight that for this attack to be successful, the attacker must possess the same IP address as a master or worker node within the target network, adding an additional layer of complexity to the exploitation process.\nWhile we haven\u2019t reversed the Cisco 0-day just yet, we do have the deep-dive and IOCs for CVE-2023-34051 affecting #VMware Aria Operations for Logs. \n\nThis vulnerability is a patch bypass discovered by @JamesHorseman2 that allows for RCE as root under certain conditions.\u2026 pic.twitter.com/L4cS6tWySy\n\n\u2014 Horizon3 Attack Team (@Horizon3Attack) October 20, 2023 RCE exploit chain This vulnerability is not an isolated concern. Instead, it is part of a chain of exploits that have previously been addressed by VMware. These earlier issues were resolved in a security update issued in January. The vulnerabilities in question included a directory traversal bug (CVE-2022-31706), a broken access control flaw (CVE-2022-31704), and an information disclosure bug (CVE-2022-31711). When chained together, these vulnerabilities could allow attackers to inject maliciously crafted files into the operating system of VMware appliances running unpatched Aria Operations for Logs software.\n\nWhile the exploitation of this vulnerability may seem straightforward, it\u2019s important to note that it does requir[...]", "creation_timestamp": "2026-09-02T01:01:05.198817Z"}