PoC Published for VMWare vCenter Server RCE Vulnerability CVE-2024-38812

Security researchers have discovered and detailed a critical remote code execution (RCE) vulnerability in the VMware vCenter Server, identified as CVE-2024-38812.

This heap-overflow flaw, which affects the server’s implementation of the DCERPC (Distributed Computing Environment/Remote Procedure Call) protocol, poses a significant threat to organizations using VMware’s virtualization management platform.

The vulnerability, published in September 2024, carries a CVSS score of 9.8, indicating its extreme severity and high risk of exploitation. VMware vCenter Server version 8.0U3a is vulnerable, while version 8.0U3b contains the necessary patches to mitigate this issue.

The flaw also impacts VMware Cloud Foundation, as outlined in VMware’s security advisory VMSA-2024-0019.

Protecting Your Networks & Endpoints With UnderDefense MDR – Request Free Demo

VMWare vCenter Server PoC Released

Security experts have provided an in-depth analysis of the vulnerability, revealing that it stems from improper memory management in the heap.

The flaw allows a malicious actor with network access to the vCenter Server to send specially crafted packets, potentially leading to remote code execution.

The vulnerability’s root cause lies in the rpc_ss_ndr_contiguous_elt() function, which handles the range_list->lower value controlled by user input.

This function modifies the base address of p_array_addr by adding an offset derived from several parameters, including the attacker-controlled range_list->lower value.

By manipulating this value, an attacker can control the memory address to which p_array_addr points, potentially allowing read or write operations in critical memory areas.

Researchers have demonstrated that the vulnerability can be triggered using a carefully crafted network packet. The packet’s “stub_data” section contains Z_values representing the conformance information for an array, which are then processed by the vulnerable function.

By manipulating these values, an attacker can create conditions that lead to a heap overflow and potential code execution.

Exploiting this vulnerability involves leveraging the memcpy function in rpc_ss_ndr_unmar_by_copying(), where attacker-controlled input can influence both the destination pointer (p_array_addr) and the length of data to be copied (IDL_left_in_buff).

This allows an attacker to control both the memory destination and the amount of memory copied, increasing the risk of memory corruption.

VMware has addressed this vulnerability in version 8.0U3b of the vCenter Server. The patch introduces additional checks on memory-boundary calculations and prevents unbounded pointer arithmetic, significantly reducing the potential for remote exploitation.

Organizations using affected versions of VMware vCenter Server are strongly advised to update to the patched version immediately.

This vulnerability underscores the critical importance of prompt patching and regular security assessments in enterprise environments, particularly for widely-used management platforms like VMware vCenter Server.

As virtualization continues to play a crucial role in modern IT infrastructure, addressing such vulnerabilities promptly is essential to maintain the security and integrity of organizational networks.

Security experts recommend that organizations apply the patch and implement additional security measures, such as network segmentation, regular vulnerability assessments, and robust monitoring systems, to detect and respond to potential exploitation attempts.

Maintaining up-to-date backups and having a comprehensive incident response plan are crucial steps in mitigating the potential impact of such critical vulnerabilities.

Run private, Real-time Malware Analysis in both Windows & Linux VMs. Get a 14-day free trial with ANY.RUN!