CVE-2024-37085 VMware ESXi Authentication Bypass
Attackers with AD permissions can regain full ESXi host access by recreating a deleted admin group, requiring prior AD configuration.
- Exploited in the wild
- Since 30 Jul 2024
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-37085?
CVE-2024-37085 is a medium-severity authentication bypass vulnerability in Vmware Cloud Foundation, published on 25 Jun 2024. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management https://blogs.vmware.com/vsphere/2012/09/joining-vsphere-hosts-to-active-directory.html by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.
Which versions are affected by CVE-2024-37085?
It affects 2 products.
Products include Vmware Cloud Foundation, Vmware Esxi.
How do I fix CVE-2024-37085?
No fix has been published for CVE-2024-37085 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 20 Aug 2024.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-37085 being exploited?
Yes. Attackers have exploited CVE-2024-37085 in the wild since at least 30 Jul 2024, including in ransomware campaigns.
Public exploit code: 3 proofs of concept on GitHub.
Other vulnerabilities in Vmware Cloud Foundation
- CVE-2024-38812 VMware vCenter Server Heap-Based Buffer Overflow
- CVE-2024-37079 Broadcom VMware vCenter Server Out-of-bounds Write
- CVE-2022-22954 VMware Workspace ONE Access and Identity Manager Server-Side Template Injection
- CVE-2021-22005 VMware vCenter Server File Upload
- CVE-2021-21985 VMware vCenter Server Improper Input Validation
Sources
Also known as GHSA-485m-923f-95wx.