Pierluigi Paganini April 01, 2021

VMware has addressed a critical authentication bypass vulnerability in the VMware Carbon Black Cloud Workload appliance.

VMware has addressed a critical vulnerability, tracked as CVE-2021-21982, in the VMware Carbon Black Cloud Workload appliance that could be exploited by attackers to bypass authentication.

Carbon Black Cloud Workload is a data center security product that protects customers’ workloads running in a virtualized environment. The solution implements Endpoint Detection and Response (EDR), next-generation anti-virus (NGAV) features, and malware protection in virtualized environments.

An attacker can manipulate an URL on the administrative interface of the VMware Carbon Black Cloud Workload appliance to bypass authentication. The flaw, rated as Critical severity, was rated with a CVSSv3 base score of 9.1.

“A malicious actor with network access to the administrative interface of the VMware Carbon Black Cloud Workload appliance may be able to obtain a valid authentication token, granting access to the administration API of the appliance.” reads the advisory published by the virtualization gian. “Successful exploitation of this issue would result in the attacker being able to view and alter administrative configuration settings.”

The issue could be exploited by remote, unauthenticated attackers to obtain a valid authentication token that can be used to access the administration API of vulnerable VMware Carbon Black Cloud Workload appliances and view/modify administrative configuration settings.

Experts pointed out that that the issue doesn’t require user interaction to be exploited.

This security vulnerability affects VMware Carbon Black Cloud Workload appliance version 1.0.1 and earlier.

The flaw was privately reported to VMware by security researcher Egor Dimitrenko from Positive Technologies.

VMware states that there is no workaround for this issue and provided mitigation for customers who can’t immediately address it in their appliances.

“VMware best practices recommend implementing network controls to limit access to the local administrative interface of the appliance. Unrestricted network access to this interface is not required for the regular operation of the product.” reads the adisory.

This week the company also addressed two vulnerabilities in its vRealize Operations (vROps) product that can expose organizations to a significant risk of attacks

If you want to receive the weekly Security Affairs Newsletter for free subscribe here.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, VMware Carbon Black Cloud Workload)

[adrotate banner=”5″]

[adrotate banner=”13″]