From d404d52075906dc1b27480a46c5139e1f7d0eb45 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 21 Jun 2023 10:33:56 -0600 Subject: [PATCH 1/4] VMware - CVE-2023-20887 VMware - CVE-2023-20887 --- ...vmware_aria_operations_exploit_attempt.yml | 67 +++++++++++++++++++ ...ria_operations_vrealize_cve_2023_20887.yml | 29 ++++++++ 2 files changed, 96 insertions(+) create mode 100644 detections/web/vmware_aria_operations_exploit_attempt.yml create mode 100644 stories/vmware_aria_operations_vrealize_cve_2023_20887.yml diff --git a/detections/web/vmware_aria_operations_exploit_attempt.yml b/detections/web/vmware_aria_operations_exploit_attempt.yml new file mode 100644 index 0000000000..6227a5fb31 --- /dev/null +++ b/detections/web/vmware_aria_operations_exploit_attempt.yml @@ -0,0 +1,67 @@ +name: VMWare Aria Operations Exploit Attempt +id: d5d865e4-03e6-43da-98f4-28a4f42d4df7 +version: 1 +date: '2023-06-21' +author: Michael Haag, Splunk +status: production +type: TTP +data_source: [] +description: The following analytic is designed to detect potential exploitation attempts against VMWare vRealize Network Insight that are consistent with the characteristics of CVE-2023-20887. It operates by monitoring web traffic (HTTP POST requests) directed towards a specific URL endpoint ("/saas./resttosaasservlet") which is known to be vulnerable. +search: '| tstats count min(_time) as firstTime max(_time) + as lastTime from datamodel=Web where Web.url IN ("*/saas./resttosaasservlet*") Web.http_method=POST Web.status IN ("unknown", "200") + by Web.http_user_agent, Web.status Web.http_method, Web.url, Web.url_length, Web.src, Web.dest, sourcetype + | `drop_dm_object_name("Web")` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `vmware_aria_operations_exploit_attempt_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + web or proxy logs, or ensure it is being filled by a proxy like device, into the + Web Datamodel. Restrict to specific dest assets to reduce false positives. +known_false_positives: False positives will be present based on gateways in use, modify the Status as needed. +references: +- https://nvd.nist.gov/vuln/detail/CVE-2023-20887 +- https://viz.greynoise.io/tag/vmware-aria-operations-for-networks-rce-attempt?days=30 +- https://github.com/sinsinology/CVE-2023-20887 +- https://summoning.team/blog/vmware-vrealize-network-insight-rce-cve-2023-20887/ +tags: + CVE: + - CVE-2023-20887 + analytic_story: + - VMware Aria Operations vRealize CVE-2023-20887 + asset_type: Web Server + atomic_guid: [] + confidence: 80 + impact: 90 + message: An exploitation attempt has occurred against $dest$ from $src$ related to CVE-2023-20887 + mitre_attack_id: + - T1133 + - T1190 + - T1210 + - T1068 + observable: + - name: dest + type: Hostname + role: + - Victim + - name: src + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 72 + required_fields: + - Web.http_method + - Web.url + - Web.url_length + - Web.src + - Web.dest + - Web.http_user_agent + security_domain: network +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/vmware/vmware_aria.log + source: pan:threat + sourcetype: pan:threat \ No newline at end of file diff --git a/stories/vmware_aria_operations_vrealize_cve_2023_20887.yml b/stories/vmware_aria_operations_vrealize_cve_2023_20887.yml new file mode 100644 index 0000000000..1ca03251e4 --- /dev/null +++ b/stories/vmware_aria_operations_vrealize_cve_2023_20887.yml @@ -0,0 +1,29 @@ +name: VMware Aria Operations vRealize CVE-2023-20887 +id: 99171cdd-57a1-4b8a-873c-f8bee12e2025 +version: 1 +date: '2023-06-21' +author: Michael Haag, Splunk +description: CVE-2023-20887 is a critical vulnerability affecting VMware's vRealize Network Insight (also known as VMware Aria Operations for Networks). It allows a remote, unauthenticated attacker to execute arbitrary commands with root privileges via the Apache Thrift RPC interface. The exploit, which has a severity score of 9.8, targets an endpoint ("/saas./resttosaasservlet") in the application and delivers a malicious payload designed to create a reverse shell, granting the attacker control over the system. VMware has released an advisory recommending users to update to the latest version to mitigate this threat. +narrative: CVE-2023-20887 is a highly critical vulnerability found in VMware's vRealize Network Insight. This software is widely used for intelligent operations management across physical, virtual, and cloud environments, so a vulnerability in it poses a significant risk to many organizations. + + This particular vulnerability lies in the application's Apache Thrift RPC interface. The exploit allows an attacker to inject commands that are executed with root privileges, leading to a potential total compromise of the system. The attacker does not need to be authenticated, which further increases the risk posed by this vulnerability. + + The exploit operates by sending a specially crafted payload to the "/saas./resttosaasservlet" endpoint. This payload contains a reverse shell command, which, when executed, allows the attacker to remotely control the victim's system. This control is obtained at the root level, providing the attacker with the ability to perform any action on the system. + + What makes this vulnerability particularly dangerous is its high severity score of 9.8, indicating it is a critical threat. It's also noteworthy that the exploitation of this vulnerability leaves specific indicators such as abnormal traffic to the "/saas./resttosaasservlet" endpoint and suspicious ncat commands in network traffic, which can help in its detection. + + VMware has acknowledged the vulnerability and has published a security advisory recommending that users update to the latest version of the software. This update effectively patches the vulnerability and protects systems from this exploit. It's crucial that all users of the affected versions of VMware's vRealize Network Insight promptly apply the update to mitigate the risk posed by CVE-2023-20887. +references: +- https://nvd.nist.gov/vuln/detail/CVE-2023-20887 +- https://summoning.team/blog/vmware-vrealize-network-insight-rce-cve-2023-20887/ +- https://viz.greynoise.io/tag/VMware-aria-operations-for-networks-rce-attempt?days=30 +- https://github.com/sinsinology/CVE-2023-20887 +tags: + analytic_story: VMware Aria Operations vRealize CVE-2023-20887 + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection From 84c34e6d0ba9a24eeceff8baba1fabaa25f8ab5b Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 21 Jun 2023 12:39:58 -0600 Subject: [PATCH 2/4] description update --- detections/web/vmware_aria_operations_exploit_attempt.yml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/detections/web/vmware_aria_operations_exploit_attempt.yml b/detections/web/vmware_aria_operations_exploit_attempt.yml index 6227a5fb31..2cdb8e15a7 100644 --- a/detections/web/vmware_aria_operations_exploit_attempt.yml +++ b/detections/web/vmware_aria_operations_exploit_attempt.yml @@ -6,7 +6,13 @@ author: Michael Haag, Splunk status: production type: TTP data_source: [] -description: The following analytic is designed to detect potential exploitation attempts against VMWare vRealize Network Insight that are consistent with the characteristics of CVE-2023-20887. It operates by monitoring web traffic (HTTP POST requests) directed towards a specific URL endpoint ("/saas./resttosaasservlet") which is known to be vulnerable. +description: The following analytic is designed to detect potential exploitation attempts against VMWare vRealize Network Insight that align with the characteristics of CVE-2023-20887. This specific vulnerability is a critical security flaw that, if exploited, could allow an attacker to execute arbitrary code on the affected system. + + The analytic operates by monitoring web traffic, specifically HTTP POST requests, directed towards a specific URL endpoint ("/saas./resttosaasservlet"). This endpoint is known to be vulnerable and is a common target for attackers exploiting this vulnerability. + + The behavior this analytic detects is the sending of HTTP POST requests to the vulnerable endpoint. This is a significant indicator of an attempted exploit as it is the primary method used to trigger the vulnerability. The analytic detects this behavior by analyzing web traffic data and identifying HTTP POST requests directed at the vulnerable endpoint. + + Identifying this behavior is crucial for a Security Operations Center (SOC) as it can indicate an active attempt to exploit a known vulnerability within the network. If the identified behavior is a true positive, it suggests an attacker is attempting to exploit the CVE-2023-20887 vulnerability in VMWare vRealize Network Insight. The impact of such an attack could be severe, potentially allowing the attacker to execute arbitrary code on the affected system, leading to unauthorized access, data theft, or further propagation within the network. search: '| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where Web.url IN ("*/saas./resttosaasservlet*") Web.http_method=POST Web.status IN ("unknown", "200") by Web.http_user_agent, Web.status Web.http_method, Web.url, Web.url_length, Web.src, Web.dest, sourcetype From 817570d6962eb697cd6e1a1b359a47c78db201cb Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 21 Jun 2023 13:33:54 -0700 Subject: [PATCH 3/4] Update vmware_aria_operations_exploit_attempt.yml added \ --- .../web/vmware_aria_operations_exploit_attempt.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/detections/web/vmware_aria_operations_exploit_attempt.yml b/detections/web/vmware_aria_operations_exploit_attempt.yml index 2cdb8e15a7..242d93302d 100644 --- a/detections/web/vmware_aria_operations_exploit_attempt.yml +++ b/detections/web/vmware_aria_operations_exploit_attempt.yml @@ -6,11 +6,11 @@ author: Michael Haag, Splunk status: production type: TTP data_source: [] -description: The following analytic is designed to detect potential exploitation attempts against VMWare vRealize Network Insight that align with the characteristics of CVE-2023-20887. This specific vulnerability is a critical security flaw that, if exploited, could allow an attacker to execute arbitrary code on the affected system. +description: The following analytic is designed to detect potential exploitation attempts against VMWare vRealize Network Insight that align with the characteristics of CVE-2023-20887. This specific vulnerability is a critical security flaw that, if exploited, could allow an attacker to execute arbitrary code on the affected system.\ - The analytic operates by monitoring web traffic, specifically HTTP POST requests, directed towards a specific URL endpoint ("/saas./resttosaasservlet"). This endpoint is known to be vulnerable and is a common target for attackers exploiting this vulnerability. + The analytic operates by monitoring web traffic, specifically HTTP POST requests, directed towards a specific URL endpoint ("/saas./resttosaasservlet"). This endpoint is known to be vulnerable and is a common target for attackers exploiting this vulnerability.\ - The behavior this analytic detects is the sending of HTTP POST requests to the vulnerable endpoint. This is a significant indicator of an attempted exploit as it is the primary method used to trigger the vulnerability. The analytic detects this behavior by analyzing web traffic data and identifying HTTP POST requests directed at the vulnerable endpoint. + The behavior this analytic detects is the sending of HTTP POST requests to the vulnerable endpoint. This is a significant indicator of an attempted exploit as it is the primary method used to trigger the vulnerability. The analytic detects this behavior by analyzing web traffic data and identifying HTTP POST requests directed at the vulnerable endpoint.\ Identifying this behavior is crucial for a Security Operations Center (SOC) as it can indicate an active attempt to exploit a known vulnerability within the network. If the identified behavior is a true positive, it suggests an attacker is attempting to exploit the CVE-2023-20887 vulnerability in VMWare vRealize Network Insight. The impact of such an attack could be severe, potentially allowing the attacker to execute arbitrary code on the affected system, leading to unauthorized access, data theft, or further propagation within the network. search: '| tstats count min(_time) as firstTime max(_time) @@ -22,7 +22,7 @@ search: '| tstats count min(_time) as firstTime max(_time) how_to_implement: To successfully implement this search, you need to be ingesting web or proxy logs, or ensure it is being filled by a proxy like device, into the Web Datamodel. Restrict to specific dest assets to reduce false positives. -known_false_positives: False positives will be present based on gateways in use, modify the Status as needed. +known_false_positives: False positives will be present based on gateways in use, modify the status field as needed. references: - https://nvd.nist.gov/vuln/detail/CVE-2023-20887 - https://viz.greynoise.io/tag/vmware-aria-operations-for-networks-rce-attempt?days=30 @@ -70,4 +70,4 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/vmware/vmware_aria.log source: pan:threat - sourcetype: pan:threat \ No newline at end of file + sourcetype: pan:threat From 67f6df47d8b8d8efb7b8d5cedf805a7a96cd6b2a Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 21 Jun 2023 13:34:39 -0700 Subject: [PATCH 4/4] Update vmware_aria_operations_vrealize_cve_2023_20887.yml --- .../vmware_aria_operations_vrealize_cve_2023_20887.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/stories/vmware_aria_operations_vrealize_cve_2023_20887.yml b/stories/vmware_aria_operations_vrealize_cve_2023_20887.yml index 1ca03251e4..2581b9d760 100644 --- a/stories/vmware_aria_operations_vrealize_cve_2023_20887.yml +++ b/stories/vmware_aria_operations_vrealize_cve_2023_20887.yml @@ -4,13 +4,13 @@ version: 1 date: '2023-06-21' author: Michael Haag, Splunk description: CVE-2023-20887 is a critical vulnerability affecting VMware's vRealize Network Insight (also known as VMware Aria Operations for Networks). It allows a remote, unauthenticated attacker to execute arbitrary commands with root privileges via the Apache Thrift RPC interface. The exploit, which has a severity score of 9.8, targets an endpoint ("/saas./resttosaasservlet") in the application and delivers a malicious payload designed to create a reverse shell, granting the attacker control over the system. VMware has released an advisory recommending users to update to the latest version to mitigate this threat. -narrative: CVE-2023-20887 is a highly critical vulnerability found in VMware's vRealize Network Insight. This software is widely used for intelligent operations management across physical, virtual, and cloud environments, so a vulnerability in it poses a significant risk to many organizations. +narrative: CVE-2023-20887 is a highly critical vulnerability found in VMware's vRealize Network Insight. This software is widely used for intelligent operations management across physical, virtual, and cloud environments, so a vulnerability in it poses a significant risk to many organizations.\ - This particular vulnerability lies in the application's Apache Thrift RPC interface. The exploit allows an attacker to inject commands that are executed with root privileges, leading to a potential total compromise of the system. The attacker does not need to be authenticated, which further increases the risk posed by this vulnerability. + This particular vulnerability lies in the application's Apache Thrift RPC interface. The exploit allows an attacker to inject commands that are executed with root privileges, leading to a potential total compromise of the system. The attacker does not need to be authenticated, which further increases the risk posed by this vulnerability.\ - The exploit operates by sending a specially crafted payload to the "/saas./resttosaasservlet" endpoint. This payload contains a reverse shell command, which, when executed, allows the attacker to remotely control the victim's system. This control is obtained at the root level, providing the attacker with the ability to perform any action on the system. + The exploit operates by sending a specially crafted payload to the "/saas./resttosaasservlet" endpoint. This payload contains a reverse shell command, which, when executed, allows the attacker to remotely control the victim's system. This control is obtained at the root level, providing the attacker with the ability to perform any action on the system.\ - What makes this vulnerability particularly dangerous is its high severity score of 9.8, indicating it is a critical threat. It's also noteworthy that the exploitation of this vulnerability leaves specific indicators such as abnormal traffic to the "/saas./resttosaasservlet" endpoint and suspicious ncat commands in network traffic, which can help in its detection. + What makes this vulnerability particularly dangerous is its high severity score of 9.8, indicating it is a critical threat. It's also noteworthy that the exploitation of this vulnerability leaves specific indicators such as abnormal traffic to the "/saas./resttosaasservlet" endpoint and suspicious ncat commands in network traffic, which can help in its detection.\ VMware has acknowledged the vulnerability and has published a security advisory recommending that users update to the latest version of the software. This update effectively patches the vulnerability and protects systems from this exploit. It's crucial that all users of the affected versions of VMware's vRealize Network Insight promptly apply the update to mitigate the risk posed by CVE-2023-20887. references: