Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers

A critical authentication bypass flaw in Xen Orchestra is being actively exploited in attacks that can give intruders administrator privileges and let them take over XCP-ng virtualization hosts. Xen Orchestra is a web-based management platform made by the French software company Vates for managing XCP-ng virtual machines, hosts, and pools. Vates has confirmed that the vulnerability is being used in live attacks and has published indicators of compromise to help administrators spot them.

According to a Vates security advisory, the flaw lies in how Xen Orchestra handles authentication tokens sent through REST API requests. After authenticating, an attacker can obtain "reusable login token IDs" from the /rest/v0/users/me/authentication_tokens REST API endpoint and use them for further access. Vates warns that an adversary can bypass authentication and carry out actions with Admin privilege, and that compromising Xen Orchestra can lead to arbitrary code execution on managed pools and a full takeover of an XCP-ng node as root.

Vates has shipped Xen Orchestra 6.9.1 (stable) and 6.10.0 (latest), which include patched xo-server packages 5.211.2 and 5.213.1 to address the vulnerabilities. Administrators are advised to install the update immediately. Where that is not possible, Vates says access to Xen Orchestra should be limited to dedicated management networks and known malicious IP addresses should be blocked.

The vulnerability was found by security researchers Filip Magic and Christoffer Olsen of TDC NET Security. Vates shared indicators of compromise tied to this campaign, starting with attacker infrastructure: connections to 91.211.251.112:8001 or to ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid.onion:3333. The company also lists modified VM configurations, specifically virtual machines set with the hvm_serial: file parameter, and unusual files at /etc/cron.d/zz-ustar, /etc/cron.d/zz-ustar2, /.ustar5, and /.ustar6.

Vates says administrators can run commands on XCP-ng hosts to check for unusual VM configurations, virtual machines configured to use a file for their serial port, and malicious files. The company notes that these indicators are associated only with this known attack campaign and may differ for other threat actors. Organizations that believe they have been compromised should rotate the passwords and secrets used by their virtualization environments.

More cybersecurity news from TechManNews.