CriticalCVE
Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers
BleepingComputer·Source published ·1 min read
What happened?
A critical authentication bypass vulnerability in Xen Orchestra is being actively exploited in attacks that could grant administrator privileges and allow takeover of XCP-ng virtualization hosts. [...]
Key details
- Critical authentication bypass flaw in Xen Orchestra allows remote attackers to gain admin access.
- Attackers send a crafted cookie with an empty JSON object to trick the platform into reusing an existing token.
- Once authenticated, attackers can retrieve reusable login token IDs via the REST API endpoint.
- Compromise can lead to arbitrary code execution on managed pools and full XCP-ng node takeover as root.
- Vates confirmed the vulnerability is being actively exploited in attacks.
- Security researchers Filip Magic and Christoffer Olsen of TDC NET Security discovered the vulnerability.
Affected
- Xen Orchestra and Xen Orchestra Appliance (XOA) are affected.
Fixes and mitigations
- Xen Orchestra 6.9.1 (stable) and 6.10.0 (latest) with patched xo-server packages 5.211.2 and 5.213.1 fix the vulnerability.
What to look for
- Connections to 91.211.251.112:8001 or ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid.onion:3333.
- HTTP requests containing authenticationToken=j:%7B%7D or authenticationToken=j:{} cookies.
- A virtual machine named pivot2.
- VMs configured with the hvm_serial: file parameter.
- Unusual files: /etc/cron.d/zz-ustar, /etc/cron.d/zz-ustar2, /.ustar5, and /.ustar6.
Summarised by SecOraLens from BleepingComputer. Always read the original source before acting. How SecOraLens verifies advisories.