Menu
March 13, 2023
By Marc Caballero
CISA identified VMware products to the CVE-2021-39144 vulnerability in its Known Exploited Vulnerabilities (KEV) catalog following confirmation from VMware that this bug is being exploited since December 2022.
The flaw was found in the XStream open-source library used by VMware products.
XStream 1.4.18 and earlier versions have a deserialization vulnerability that received the Common Vulnerabilities and Exposures (CVE) number CVE-2021-39144. This vulnerability allows an attacker to manipulate the input stream for remote code execution in products that use the XStream library.
“Due to an unauthenticated endpoint that leverages XStream for input serialization in VMware Cloud Foundation (NSX-V), a malicious actor can get remote code execution in the context of ‘root’ on the appliance,” VMware explains in their security advisory.
VMware released security updates (see product response matrix) to mitigate the flawed components reported by Sina Kheirkhah of MDSec and Steven Seeley of Source Incite last October 2022.
In addition, VMware issued patches for end-of-life versions of Cloud Foundation Network Security Virtualization for vSphere (NSX-V) to address a critical vulnerability in the Xstream open-source library.