Security concerns have emerged as a critical vulnerability in Xen Orchestra is being actively exploited, warns Vates, the software’s developer. This flaw, rated as high-severity, permits attackers to bypass authentication measures, posing significant risks to users.
Understanding Xen Orchestra’s Role
Xen Orchestra functions as a comprehensive web-based management tool designed for XCP-ng and XenServer environments. Its agentless operation allows for centralized oversight of hosts, virtual machines, storage solutions, and resource pools. However, this centralization can become a target if security vulnerabilities are exploited.
Details of the Exploited Vulnerability
The vulnerability stems from issues within the REST authentication system. Specifically, an authentication token can be manipulated into an empty object, which is then treated as an unfiltered lookup. This loophole results in the return of the initial token from the collection, enabling unauthorized access if the token remains valid and unexpired.
This exploit allows attackers to bypass standard authentication procedures, gaining unwarranted administrative access. Such a breach can lead to arbitrary code execution across managed pools, potentially resulting in a complete takeover of XCP-ng nodes with root access, as Vates elucidates.
Additional Threats and Company Recommendations
Further compounding the issue, a secondary vulnerability was uncovered and is being exploited by the same threat actor. With administrator privileges, the attacker can import malicious virtual machines, jeopardizing the integrity of XCP-ng hosts. Vates is actively working on a solution to address this flaw.
The exploits reportedly originate from a threat actor using the IP address 91.211.251.112:8001 and operating through the Tor network. While no CVE identifier has been assigned, Vates has provided indicators of compromise (IoCs) to assist users in identifying potential breaches.
To mitigate risks, Vates advises that Xen Orchestra instances should be isolated behind dedicated networks. Additional precautions include blocking known malicious IPs and domains, implementing Web Application Firewall (WAF) rules to prevent empty token usage, and rotating any credentials that might have been compromised.
In situations where a compromise is confirmed, Vates strongly recommends a complete system reinstallation to eliminate any remaining backdoors left by the attackers.
Related security updates have been released by other companies, including Asus, Zoom, Citrix, and Ivanti, addressing various critical vulnerabilities.
