Critical RCE bug in VMware vCenter Server now exploited in attacks

​Broadcom warned today that attackers are now exploiting two VMware vCenter Server vulnerabilities, one of which is a critical remote code execution flaw.

TZL security researchers reported the RCE vulnerability (CVE-2024-38812) during China's 2024 Matrix Cup hacking contest. It is caused by a heap overflow weakness in the vCenter's DCE/RPC protocol implementation and affects products containing vCenter, including VMware vSphere and VMware Cloud Foundation.

The other vCenter Server flaw now exploited in the wild (reported by the same researchers) is a privilege escalation flaw tracked as CVE-2024-38813 that enables attackers to escalate privileges to root with a specially crafted network packet.

"Updated advisory to note that VMware by Broadcom confirmed that exploitation has occurred in the wild for CVE-2024-38812 and CVE-2024-38813," Broadcom said on Monday.

The company released security updates in September to fix both vulnerabilities. Still, roughly one month later, it updated the security advisory warning that the original CVE-2024-38812 patch hadn't fully addressed the flaw and "strongly" encouraged admins to apply the new patches.

No workarounds are available for these security flaws, so impacted customers are advised to apply the latest updates immediately to block attacks actively exploiting them.

Broadcom has also released a supplemental advisory with additional information on deploying the security updates on vulnerable systems and known issues that could impact those who have already upgraded.

In June, the company fixed a similar vCenter Server RCE vulnerability (CVE-2024-37079) that attackers can also exploit via specially crafted packets.

Threat actors, including ransomware gangs and state-sponsored hacking groups, frequently target vulnerabilities in VMware vCenter. For instance, in January, Broadcom revealed that Chinese state hackers had been exploiting a critical vCenter Server vulnerability (CVE-2023-34048) as a zero-day since at least late 2021.

This threat group (tracked as UNC3886 by security firm Mandiant) abused the flaw to deploy VirtualPita and VirtualPie backdoors on ESXi hosts via maliciously crafted vSphere Installation Bundles (VIBs).