A threat actor has been exploiting a critical-severity authentication bypass and a zero-day in Xen Orchestra, software maker Vates warns.
A web-based backup, management, and disaster recovery solution for XCP-ng and XenServer virtualization environments, Xen Orchestra operates as an agentless control center across hosts, VMs, storage, and pools.
The critical flaw exists in the REST authentication mechanism, where an authentication token is turned into {} and then treated as an unfiltered lookup, leading to the first token being returned by token collection. If the token is not expired, the provider authenticates as its owner.
This opens a route that exposes reusable login token IDs, allowing unauthenticated attackers to bypass authentication and gain administrator privileges.
“Xen Orchestra compromise can lead to arbitrary code execution on managed pools and a full XCP-ng node takeover as root,” Vates says.
The security defect impacts Xen Orchestra releases before 6.9.2 (stable) and 6.10.1 (latest), and Xen Orchestra Appliance, which contains Xen Orchestra.
Vates warned that the same threat actor has been exploiting this bug and a zero-day vulnerability that requires administrator privileges. The zero-day allows malicious VM imports that could compromise XCP-ng hosts, and a fix is still being developed.
According to the company, the attacker initially operated from 91.211.251.112:8001 and via the Tor network. No CVE identifier has been assigned to the security defects.
The company warns that unauthorized access is not logged, but has shared indicators of compromise (IoCs) associated with the observed attacks, and warns that they are limited to this specific campaign.
“Exploitation of the vulnerability by other threat actors using different TTPs and infrastructure cannot be ruled out. The absence of these IoCs alone is not sufficient to conclude that no compromise has occurred,” Vates notes.
The company recommends placing Xen Orchestra instances behind a dedicated network, blocking IP addresses and domain names associated with known malicious activity, blocking the empty token in a WAF rule, and rotating all potentially compromised credentials.
“In case of a confirmed compromise, a full reinstallation is recommended as cleanup alone cannot guarantee the removal of all backdoors left by the attacker,” Vates says.
Related: Asus, Zoom Release Security Patches
Related: Citrix, Ivanti Patch Critical and High-Severity Vulnerabilities
Related: Threat Actors Exploit Openwave, Cisco BroadWorks Vulnerabilities
Related: Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft
