漏洞描述
VMWare Aria Operations for Networks (vRealize Network Insight) is vulnerable to command injection when accepting user input through the Apache Thrift RPC interface. This vulnerability allows a remote unauthenticated attacker to execute arbitrary commands on the underlying operating system as the root user. The RPC interface is protected by a reverse proxy which can be bypassed. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8. A malicious actor can get remote code execution in the context of 'root' on the appliance. VMWare 6.x version are vulnerable.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
www.vmware.comhttps://www.vmware.com/security/advisories/VMSA-2023-0012.html↗summoning.teamhttps://summoning.team/blog/vmware-vrealize-network-insight-rce-cve-2023-20887/↗github.comhttps://github.com/sinsinology/CVE-2023-20887↗packetstormsecurity.comhttp://packetstormsecurity.com/files/173761/VMWare-Aria-Operations-For-Networks-Remote-Command-Execution.html↗github.comhttps://github.com/ARPSyndicate/cvemon↗