VMware vCenter Server critical RCE and privilege escalation flaws
VMware vCenter Server contains critical RCE and privilege escalation vulnerabilities (CVE-2024-38812, CVE-2024-38813) requiring immediate patching.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2024-38812 and CVE-2024-38813 as exploited in the wild.
Japan's Information-Technology Promotion Agency (IPA) has issued an alert regarding two vulnerabilities affecting VMware vCenter Server, a virtualisation environment management tool provided by Broadcom. The first vulnerability (CVE-2024-38812) is a heap-based buffer overflow in the DCE/RPC protocol implementation that enables remote code execution. The second vulnerability (CVE-2024-38813) is a privilege escalation flaw allowing non-administrator users to gain root privileges.
Exploitation of these vulnerabilities could allow authenticated third parties with vCenter Server access to execute arbitrary code or escalate privileges to root level. The advisory emphasises the potential for widespread impact and urges immediate application of vendor-provided patches. The alert was initially published on 18 September 2024 and updated on 22 October 2024 with information about available remediation patches from Broadcom.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by vCenter Server DCE/RPC Service (Possible CVE-2024-38812 Exploitation)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects an unexpected shell or scripting interpreter being spawned as a child of vCenter Server's vpxd/DCE-RPC related service processes, consistent with exploitation of the heap-based buffer overflow RCE vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process from vCenter vpxd Service
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|contains:
- vpxd
- vmware-vpxd
- rhttpproxy
suspicious_child:
Image|endswith:
- /sh
- /bash
- /dash
- /python
- /python3
- /perl
- /curl
- /wget
- /nc
- /ncat
condition: selection and suspicious_child
falsepositives:
- Legitimate vCenter maintenance scripts or health-check cron jobs invoking shell/python
interpreters
- VMware support/diagnostic tooling that legitimately shells out from vpxd for log
collection
level: high
tags:
- attack.t1203
- attack.execution
id: 3eca90ed-284c-5144-b603-6760b01735ed
status: experimental
author: Vorant
Root Privilege Escalation from Non-Root vCenter Service Context
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a vCenter Server service process running under a non-root account spawning a process that executes with root/uid 0 privileges without a standard privilege-escalation mechanism (e.g., sudo), consistent with exploitation of CVE-2024-38813 privilege escalation flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unexpected Root Process Spawned from vCenter Service Account
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|contains:
- vpxd
- vmware-vpxd
- vmware-sts
- vmware-vmon
root_uid:
User: root
filter_sudo:
ParentImage|endswith:
- /sudo
- /su
condition: selection and root_uid and not filter_sudo
falsepositives:
- Normal vCenter appliance patching or update jobs that legitimately re-exec as root
through vmware-vmon
- Scheduled maintenance scripts that intentionally elevate via approved service management
components
level: medium
tags:
- attack.t1068
- attack.privilege-escalation
id: c19b1a3f-0eab-56ad-8507-ec6d18c4648c
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/security/security-alert/2024/alert20240918.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs