Medium · published June 25, 2024
CVSS calls it medium at 6.8. It is confirmed in active exploitation. It sits in the 98.0th percentile for exploit probability.
⚠️ An attacker with Active Directory permissions can effortlessly re-create a deleted admin group, gaining full control of your VMware ESXi host! 🎭 Think of this like a hotel where the main entrance lock is broken. If someone has the right keys (AD permissions), they can simply remove the sign saying 'Authorized Personnel Only' and waltz in as if they belong. No one would question them! If exploited, this could lead to unauthorized access, allowing attackers to manipulate or steal sensitive data on your ESXi host. Imagine the chaos if a stranger roamed freely in your network, altering settings and potentially damaging critical infrastructure!
Think of this like a hotel where the main entrance lock is broken. If someone has the right keys (AD permissions), they can simply remove the sign saying 'Authorized Personnel Only' and waltz in as if they belong. No one would question them! This authentication bypass vulnerability allows a malicious actor with sufficient AD permissions to regain access by recreating the 'ESXi Admins' group after it's been deleted, effectively bypassing authentication checks.
If exploited, this could lead to unauthorized access, allowing attackers to manipulate or steal sensitive data on your ESXi host. Imagine the chaos if a stranger roamed freely in your network, altering settings and potentially damaging critical infrastructure! To mitigate this risk, ensure that all AD permissions are regularly audited and limit access to the deletion of critical groups. Consider updating to the latest VMware ESXi version, which addresses this vulnerability. Stay vigilant and implement strong access controls! You've got this! Following these steps, you can keep your ESXi host secure from unauthorized access. 🛡️