XXE vulnerability affecting VMware vRealize Orchestrator

Source: https://www.vmware.com/security/advisories/VMSA-2023-0005.html


Tip Upgrade your vRO/vRA to version 8.11.1 as soon as possible to overcome this vulnerability.


  1. Impacted Products
  2. Introduction
  3. 3. XML External Entity (XXE) Vulnerability (CVE-2023-20855)
    1. Description
    2. Known Attack Vectors
    3. Resolution
    4. Workarounds
    5. Additional Documentation
    6. Notes
    7. Acknowledgements
    8. Response Matrix
    9. Impacted Product Suites that Deploy Response Matrix Components:
  4. References
  5. Change Log
  6. Contact

Impacted Products

  • VMware vRealize Orchestrator
  • VMware vRealize Automation
  • VMware Cloud Foundation (Cloud Foundation) 

Introduction

An XML External Entity (XXE) vulnerability affecting VMware vRealize Orchestrator was privately reported to VMware. Updates are available to address this vulnerability in affected VMware products.

3. XML External Entity (XXE) Vulnerability (CVE-2023-20855)

Description

VMware vRealize Orchestrator contains an XML External Entity (XXE) vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 8.8.

Known Attack Vectors

A malicious actor, with non-administrative access to vRealize Orchestrator, may be able to use specially crafted input to bypass XML parsing restrictions leading to access to sensitive information or possible escalation of privileges.

Resolution

To remediate CVE-2023-20855 apply the patches listed in the ‘Fixed Version’ column of the ‘Response Matrix’ below.

Workarounds

None.

Additional Documentation

None.

Notes

VMware vRealize Automation 8.x is affected since it uses embedded vRealize Orchestrator.

Acknowledgements

VMware would like to thank IT.NRW for reporting this issue to us.

Response Matrix

ProductVersionRunning OnCVE IdentifierCVSSv3SeverityFixed VersionWorkaroundsAdditional Documentation
VMware vRealize Orchestrator8.xVirtual ApplianceCVE-2023-208558.8Important 8.11.1NoneNone
VMware vRealize Automation8.xAnyCVE-2023-208558.8Important 8.11.1NoneNone

Impacted Product Suites that Deploy Response Matrix Components:

ProductVersionRunning OnCVE IdentifierCVSSv3SeverityFixed VersionWorkaroundsAdditional Documentation
VMware Cloud Foundation (vRealize Automation)4.xAnyCVE-2023-208558.8Important KB90926NoneNone

References

GitHub Advisory DB: https://github.com/advisories/GHSA-3hq4-5qpg-7776

NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-20855

Hacker News: https://thehackernews.com/2023/02/vmware-patches-critical-vulnerability.html

Securoty Online: https://securityonline.info/vmware-patches-critical-cve-2023-20858-vulnerability-in-carbon-black-app-control/

Cloud Foundation (vRealize Automation) KB90926: https://kb.vmware.com/s/article/90926

Mitre CVE Dictionary Links:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20855

FIRST CVSSv3 Calculator:
https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Change Log

2023-02-21 VMSA-2023-0005

Initial security advisory. 

Contact

E-mail: security@vmware.com

PGP key at:
https://kb.vmware.com/kb/1055 

VMware Security Advisories
https://www.vmware.com/security/advisories 

VMware Security Response Policy
https://www.vmware.com/support/policies/security_response.html 

VMware Lifecycle Support Phases
https://www.vmware.com/support/policies/lifecycle.html 

VMware Security & Compliance Blog  
https://blogs.vmware.com/security 

Twitter
https://twitter.com/VMwareSRC

Advertisement

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s