NSA Warns Russian Hacker Exploiting VMware Bug to Breach Corporate Networks

The US National Security Agency (NSA) on Monday issued an
advisory^[1]
warning that Russian threat actors are leveraging recently
disclosed VMware vulnerability to install malware on corporate
systems and access protected data.

Specifics regarding the identities of the threat actor
exploiting the VMware flaw^[2]
or when these attacks started were not disclosed.

The development comes two weeks after the virtualization
software company publicly disclosed the flaw—affecting VMware
Workspace One Access, Access Connector, Identity Manager, and
Identity Manager Connector products for Windows and Linux—without
releasing a patch and three days after releasing a software update
to fix it.

In late November, VMware pushed temporary
workarounds^[3] to address the issue,
stating permanent patches for the flaw were “forthcoming.” But it
wasn’t until December 3rd the escalation-of-privileges bug was
entirely resolved.

That same day, the US Cybersecurity and Infrastructure Security
Agency (CISA) issued a brief bulletin^[4]
encouraging administrators to review and apply and patch as soon as
possible.

Tracked as CVE-2020-4006, the command injection^[5]
vulnerability was originally given a CVSS score of 9.1 out of a
maximum of 10 but was revised last week to 7.2 to reflect the fact
that a malicious actor must possess valid credentials for the
configurator admin account in order to attempt exploitation.

“This account is internal to the impacted products and a
password is set at the time of deployment,” VMware said in its
advisory^[6]. “A malicious actor must
possess this password to attempt to exploit CVE-2020-4006.”

Although VMware didn’t explicitly mention the bug was under
active exploitation in the wild, according to the NSA, adversaries
are now leveraging the flaw to launch attacks to pilfer protected
data and abuse shared authentication systems.

“The exploitation via command injection led to installation of a
web shell and follow-on malicious activity where credentials in the
form of SAML authentication assertions were generated and sent to
Microsoft Active Directory Federation Services, which in turn
granted the actors access to protected data,” the agency said.

SAML^[7]
or Security Assertion Markup Language is an open standard and an
XML-based markup for exchanging authentication and authorization
data between identity providers and service providers to facilitate
single sign-on (SSO^[8]).

Besides urging organizations to update affected systems to the
latest version, the agency also recommended securing the management
interface with a strong, unique password.

Furthermore, the NSA advised enterprises to regularly monitor
authentication logs for anomalous authentications as well as scan
their server logs for the presence of “exit statements” that can
suggest possible exploitation activity.