CVE-2020-3952 VMWare vCenter Software Vulnerability

VMWare vCenter Software Vulnerability Details

This report is about a vulnerability found in the VMWare vCenter software known as CVE-2020-3952. The vulnerability is caused by improper access controls affecting the VMware Directory Service. The affected version of the software is vCenter 6.7 with a patch available for this software flaw.

CVE-2020-3952 Tactics, Techniques, and Procedures

The root cause of this vulnerability is the improper implementation of access controls allowing a bad actor to extract highly sensitive information from the VMware Directory Service (vmdir). When this software flaw is successfully exploited, a bad actor with network access can target the authentication mechanisms within vCenter. The vulnerability affects both the vCenter Server Appliance and the vCenter Server on Windows. This software flaw only exists in vCenter version 6.7 and can be fixed by applying patch 6.7u3f or upgrading to version 7.0.

The vulnerability only affects deployments where an in-place upgrade was used instead of a clean install of version 6.7.

CVE-2020-3952 Potential Impact

This CVE-2020-3952 vulnerability could result in the loss of sensitive information which may lead to the compromise of a critical asset. There’s a strong possibility that a bad actor may be able to bypass the authentication mechanisms of the vCenter Server and gain full control of the affected host.

If control is lost, the bad actor could make changes to the host and extract valuable data from the virtual machines residing on the deployment.

Recommendations for this Vulnerability

It’s highly encouraged that you implement the vendor patch linked below to eliminate the CVE-2020-3952 vCenter Software Vulnerability. You should:

• Consider implementing strong protections such as single sign-on (SSO) and using the built-in access control list system to limit who can access the vCenter server?
• Utilize the least privilege principle for users accessing the vCenter deployment by building custom roles and restricting access to sensitive locations like the datastore.
• Monitor user activity on the vCenter server and perform auditing of the logs regularly.
• Ensure that any SSL/TLS implementations utilize the highest security settings possible and maintain strict security controls on any protocols used.

Sources

IBM X-Force Exchange:

• https://exchange.xforce.ibmcloud.com/vulnerabilities/179427

Supporting Documentation:

• VMWare Links:
  • Patch Link: https://www.vmware.com/security/advisories/VMSA-2020-0006.html
  • VMWare Knowledgebase Post: https://kb.vmware.com/s/article/78543
  • vCenter Security Best Practices:
    • Access Control: https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.vsphere.security.doc/GUID-6C181D08-6650-4AD1-92D1-AAFDA3A3E38C.html
    • Windows Host: https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.vsphere.security.doc/GUID-4F7BF744-6052-43F2-A62E-6B05C13E755B.html
• ISC SANS Storm Center Post: https://isc.sans.edu/forums/diary/Critical+Vuln+in+vCenter+vmdir+CVE20203952/26006/

Note: The Avertium Threat Report analyzes one current threat that has been shared by threat intelligence networks across the globe. Used internally by the Avertium CyberOps Team, this report outlines a “top-of-mind” threat and how it ought to be addressed accordingly.

This informed analysis is based on the latest data available.

Contact us for more information about Avertium’s managed detection and response service capabilities.