A malicious actor exploited a critical severity vulnerability in Xen Orchestra to bypass authentication, software company Vates warns.
A web-based backup, management, and disaster recovery solution for XCP-ng and XenServer virtualization environments, Xen Orchestra functions as an agentless control center across hosts, virtual machines, storage, and pools.
The exploited flaw exists in the REST authentication mechanism, where an authentication token is transformed into {} and then treated as an unfiltered search, leading to the token collection returning the first token. If the token has not expired, the provider authenticates as the owner.
This opens a route that exposes reusable login token IDs, allowing unauthenticated attackers to bypass authentication and gain administrative privileges.
“Compromise of Xen Orchestra can lead to arbitrary code execution on managed pools and a complete takeover of the XCP-ng node as root,” Vates says.
The security flaw affects versions of Xen Orchestra before 6.9.2 (stable) and 6.10.1 (latest), as well as Xen Orchestra Appliance, which contains Xen Orchestra.
Vates also disclosed a second vulnerability which the same malicious actor exploited using administrator privileges. The flaw allows malicious virtual machine imports that could compromise XCP-ng hosts, and a fix is still in development.
Vates claims that a malicious actor initially operating from 91.211.251.112:8001 and through the Tor network exploited the vulnerabilities. No CVE IDs have been assigned to the security flaws.
The company cautions that unauthorized access is not logged, but has shared indicators of compromise (IoCs) associated with the observed attacks, and cautions that they are limited to this specific campaign.
“Exploitation of the vulnerability by other malicious actors using TTPs and different infrastructures cannot be ruled out. The absence of these IoCs alone is not enough to conclude that no compromise has taken place,” notes Vates.
The company recommends placing Xen Orchestra instances behind a dedicated network, blocking IP addresses and domain names associated with known malicious activity, blocking the empty token in a WAF rule, and rotating any potentially compromised credentials.
“In the event of a confirmed compromise, a complete reinstallation is recommended because cleaning alone cannot guarantee the removal of all backdoors left by the attacker,” says Vates.
Related: Asus and Zoom release security patches
Related: Citrix and Ivanti Patch Critical and High Severity Vulnerabilities
Related: Threat actors exploit Openwave and Cisco BroadWorks vulnerabilities
Related: Outlook Zero-Day exploited among 1,094 vulnerabilities patched by Microsoft
