| Title | VMware vCenter Server LDAP Broken Access Control |
|---|---|
| Author | 0x_Akoko |
| Severity | Critical |
| Impact | Unauthorized users may access sensitive functions, potentially leading to privilege escalation or data exposure. |
| Remediation | Apply the latest security patches and updates provided by VMware to address access control issues. |
| CVSS Score | 9.8 |
| EPSS Score | 0.94355 |
| CVE ID | CVE-2020-3952 |
| CWE ID | CWE-306 |
| Tags | cve cve2020 vmware vcenter ldap auth-bypass passive kev vkev |
Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctly implement access controls.
POST /sdk/ HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Connection: close
Content-Length: 538
Content-Type: text/xml
SOAPAction: "urn:vim25/6.5"
Accept-Encoding: gzip
<?xml version="1.0" encoding="UTF-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<soap:Header>
<operationID>00000001-00000001</operationID>
</soap:Header>
<soap:Body>
<RetrieveServiceContent xmlns="urn:internalvim25">
<_this xsi:type="ManagedObjectReference" type="ServiceInstance">ServiceInstance</_this>
</RetrieveServiceContent>
</soap:Body>
</soap:Envelope>
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-3952.yaml
🦈 Packet Capture: ⬇️ Download cve-2020-3952.pcap
N/AN/A