VMware Aria vulnerable to critical SSH authentication bypass flaw

VMware Aria Operations for Networks (formerly vRealize Network Insight) is vulnerable to a critical severity authentication bypass flaw that could allow remote attackers to bypass SSH authentication and access private endpoints.

VMware Aria is a suite for managing and monitoring virtualized environments and hybrid clouds, enabling IT automation, log management, analytics generation, network visibility, security and capacity planning, and full-scope operations management.

Yesterday, the vendor published a security advisory warning of a flaw that impacts all Aria 6.x branch versions.

The flaw, discovered by analysts at ProjectDiscovery Research, is tracked as CVE-2023-34039 and has received a CVSS v3 scope of 9.8, rating it “critical.”

“Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key generation,” warns VMware’s advisory regarding the flaw.

“A malicious actor with network access to Aria Operations for Networks could bypass SSH authentication to gain access to the Aria Operations for Networks CLI.”

The exploitation of CVE-2023-34039 could lead to data exfiltration or manipulation through the product’s command line interface. Depending on the configuration, this access can lead to network disruption, configuration modification, malware installation, and lateral movement.

The vendor has not provided any workarounds or mitigation recommendations, so the only way to remediate the critical flaw is to upgrade to version 6.11 or apply the KB94152 patch on earlier releases.

You can find the right security update package and installation instructions for the specific version you’re using from this webpage.

A second, high-severity (CVSS v3: 7.2) flaw addressed by the same patch is CVE-2023-20890. This arbitrary file write problem may allow an attacker with administrative access to the target to perform remote code execution.

Due to this software being used in large organizations holding valuable assets, hackers are quick to exploit critical severity flaws impacting these products.

In June 2023, VMware warned its clients about the active exploitation of CVE-2023-20887, a remote code execution vulnerability impacting Aria Operations for Networks.

The mass-scan and exploitation efforts started a week after the vendor made a security update that addressed the problem available and just two days after a working PoC (proof of concept) exploit was published.

That said, any delay in applying the KB94152 patch or upgrading to Aria version 6.11 would put your network at significant risk of hacker attacks.

Original Source