VMWare vCenter Software Vulnerability Details
This report is about a vulnerability found in the VMWare vCenter software known as CVE-2020-3952. The vulnerability is caused by improper access controls affecting the VMware Directory Service. The affected version of the software is vCenter 6.7 with a patch available for this software flaw.
CVE-2020-3952 Tactics, Techniques, and Procedures
The root cause of this vulnerability is the improper implementation of access controls allowing a bad actor to extract highly sensitive information from the VMware Directory Service (vmdir). When this software flaw is successfully exploited, a bad actor with network access can target the authentication mechanisms within vCenter. The vulnerability affects both the vCenter Server Appliance and the vCenter Server on Windows. This software flaw only exists in vCenter version 6.7 and can be fixed by applying the patch 6.7u3f or upgrading to version 7.0.
The vulnerability only affects deployments where an in-place upgrade was used instead of a clean install of version 6.7.
CVE-2020-3952 Potential Impact
This CVE-2020-3952 vulnerability could result in the loss of sensitive information which may lead to the compromise of a critical asset. There’s a strong possibility that a bad actor may be able to bypass the authentication mechanisms of the vCenter Server and gain full control of the affected host.
If control is lost, the bad actor could make changes to the host and extract valuable data from the virtual machines residing on the deployment.
Recommendations for this Vulnerability
It’s highly encouraged that you implement the vendor patch linked below to eliminate the CVE-2020-3952 vCenter Software Vulnerability. You should:
- Consider implementing strong protections such as single sign-on (SSO) and using the built-in access control list system to limit who can access the vCenter server.
- Utilize the least privilege principle for users accessing the vCenter deployment by building custom roles and restricting access to sensitive locations like the datastore.
- Monitor user activity on the vCenter server and perform auditing of the logs regularly.
- Ensure that any SSL/TLS implementations utilize the highest security settings possible and maintain strict security controls on any protocols used.
IBM X-Force Exchange:
- VMWare Links:
- VMWare Knowledgebase Post: https://kb.vmware.com/s/article/78543
- vCenter Security Best Practices:
- Access Control: https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.vsphere.security.doc/GUID-6C181D08-6650-4AD1-92D1-AAFDA3A3E38C.html
- ISC SANS Storm Center Post: https://isc.sans.edu/forums/diary/Critical+Vuln+in+vCenter+vmdir+CVE20203952/26006/
Note: The Avertium Threat Report analyzes one current threat that has been shared by threat intelligence networks across the globe. Used internally by the Avertium CyberOps Team, this report outlines a “top-of-mind” threat and how it ought to be addressed accordingly.
This informed analysis is based on the latest data available.
Contact us for more information about Avertium’s managed detection and response service capabilities.