How to Fix CVE-2021-39144- A Critical RCE Vulnerability in VMware Cloud Foundation

VMWare published an advisory on 25th Oct 2022 in which it disclosed two vulnerabilities in VMware Cloud Foundation. The flaw tracked as CVE-2022-31678 is rated Critical with a CVSS score of 9.8, and another one which is tracked under the identifier CVE-2021-39144 is rated Moderate in severity with a CVSS score of 5.3 respectively. As per the report, attackers could abuse these vulnerabilities to carry out remote code execution and XML External Entity (XXE) attacks on vulnerable VMware Cloud Foundation. Considering the severity of the flaws, it is highly recommended that all organizations should work on patching the flaws on their VMWare Cloud Foundation. We have created this post to help you know how to fix CVE-2021-39144, a critical RCE vulnerability in VMware Cloud Foundation.

A Short Introduction About VMware Cloud Foundation

VMware Cloud Foundation is a complete cloud infrastructure platform that bundles computing, storage, networking, security, and cloud management into a single integrated stack. By running on industry-standard hardware, it delivers the agility and efficiency of the public cloud without sacrificing the security and control of on-premise data centers.

In addition to providing a unified platform for private, hybrid, and public clouds, VMware Cloud Foundation also enables customers to take advantage of new services and capabilities from VMware as they become available. This includes features such as NSX networking and security, vSAN storage, and vRealize management and automation.

VMware Cloud Foundation is an ideal platform for organizations that are looking to build private, hybrid, or public clouds. It provides a unified platform that can be easily deployed and managed while still giving customers the flexibility to choose the right mix of computing, storage, networking, and security for their needs. If you’re interested in learning more about VMware Cloud Foundation, be sure to check out our other resources.

A Short Introduction About VMware Cloud Foundation NSX

VMware Cloud Foundation is a cloud infrastructure platform that integrates and automates VMware vSphere, vSAN, NSX, and SDDC Manager into a single platform. This unified software-defined data center (SDDC) stack reduces operational complexity and provides a more efficient way to run your IT workloads.

NSX is the network virtualization platform for the SDDC. It enables you to create, manage, and grow your network without the need for physical hardware. NSX provides a complete set of networking and security features that are essential for running today’s modern applications in the cloud.

The integration of NSX into VMware Cloud Foundation makes it easy to deploy and operate a consistent, secure, and efficient SDDC infrastructure. NSX provides the network virtualization capabilities that are needed to support the multi-tenant, hybrid cloud environments of tomorrow.

VMware Cloud Foundation NSX is the perfect solution for businesses that are looking to simplify their IT infrastructure and reduce operational costs. It is a complete SDDC platform that enables you to quickly deploy and manage your workloads in the cloud.

Summary of CVE-2021-39144

This is a remote code execution vulnerability in VMware Cloud Foundation (NSX-V). This vulnerability is rated critical and assigned a CVSS score of 9.8 out of 10 and is due to a lack of input tantalization in VMware Cloud Foundation (NSX-V). It allows an unauthenticated, remote attacker to exploit these vulnerabilities and execute arbitrary code on vulnerable devices. 

“Due to an unauthenticated endpoint that leverages XStream for input serialization in VMware Cloud Foundation (NSX-V), a malicious actor can get remote code execution in the context of ‘root’ on the appliance.”


-VMWare

Summary of CVE-2022-31678

This is an XML External Entity (XXE) vulnerability in VMware Cloud Foundation (NSX-V). This vulnerability is rated moderate and assigned a CVSS score of 5.3 out of 10 and is due to a lack of input tantalization in VMware Cloud Foundation (NSX-V). It allows an unauthenticated, remote attacker to exploit these vulnerabilities and creates a denial-of-service-like condition or unintended information disclosure.