VMware vCenter Server contains critical RCE and privilege escalation vulnerabilities…
VMware vCenter Server contains critical RCE and privilege escalation vulnerabilities (CVE-2024-38812, CVE-2024-38813) requiring immediate patching.
Japan's Information-Technology Promotion Agency (IPA) has issued an alert regarding two vulnerabilities affecting VMware vCenter Server, a virtualisation environment management tool provided by Broadcom. The first vulnerability (CVE-2024-38812) is a heap-based buffer overflow in the DCE/RPC protocol implementation that enables remote code execution. The second vulnerability (CVE-2024-38813) is a privilege escalation flaw allowing non-administrator users to gain root privileges.
Exploitation of these vulnerabilities could allow authenticated third parties with vCenter Server access to execute arbitrary code or escalate privileges to root level. The advisory emphasises the potential for widespread impact and urges immediate application of vendor-provided patches. The alert was initially published on 18 September 2024 and updated on 22 October 2024 with information about available remediation patches from Broadcom.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by vCenter Server DCE/RPC Service (Possible CVE-2024-38812 Exploitation)
Detects an unexpected shell or scripting interpreter being spawned as a child of vCenter Server's vpxd/DCE-RPC related service processes, consistent with exploitation of the heap-based buffer overflow RCE vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process from vCenter vpxd Service
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|contains:
- vpxd
- vmware-vpxd
- rhttpproxy
suspicious_child:
Image|endswith:
- /sh
- /bash
- /dash
- /python
- /python3
- /perl
- /curl
- /wget
- /nc
- /ncat
condition: selection and suspicious_child
falsepositives:
- Legitimate vCenter maintenance scripts or health-check cron jobs invoking shell/python
interpreters
- VMware support/diagnostic tooling that legitimately shells out from vpxd for log
collection
level: high
tags:
- attack.t1203
- attack.execution
id: 3eca90ed-284c-5144-b603-6760b01735ed
status: experimental
author: Vorant
Root Privilege Escalation from Non-Root vCenter Service Context
Detects a vCenter Server service process running under a non-root account spawning a process that executes with root/uid 0 privileges without a standard privilege-escalation mechanism (e.g., sudo), consistent with exploitation of CVE-2024-38813 privilege escalation flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unexpected Root Process Spawned from vCenter Service Account
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|contains:
- vpxd
- vmware-vpxd
- vmware-sts
- vmware-vmon
root_uid:
User: root
filter_sudo:
ParentImage|endswith:
- /sudo
- /su
condition: selection and root_uid and not filter_sudo
falsepositives:
- Normal vCenter appliance patching or update jobs that legitimately re-exec as root
through vmware-vmon
- Scheduled maintenance scripts that intentionally elevate via approved service management
components
level: medium
tags:
- attack.t1068
- attack.privilege_escalation
id: c19b1a3f-0eab-56ad-8507-ec6d18c4648c
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/security/security-alert/2024/alert20240918.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free