Pierluigi Paganini
July 25, 2023
VMware has addressed an information disclosure vulnerability, tracked as CVE-2023-20891 (CVSSv3 score 6.5), in VMware Tanzu Application Service for VMs (TAS for VMs) and Isolation Segment that exposed logged credentials via system audit logs.
VMware Tanzu Application Service for VMs allows organizations to deploy and manage modern applications in a virtualized infrastructure environment.
A remote attacker with low privileges, and who has access to the platform system audit logs, can exploit the vulnerability to access CF API admin credentials in hex encoding.
The company pointed out that in a default installation, non-admin users do not have access to the platform system audit logs.
“The VMware Tanzu Application Service for VMs and Isolation Segment contain an information disclosure vulnerability due to the logging of credentials in hex encoding in platform system audit logs.” reads the advisory. “A malicious non-admin user who has access to the platform system audit logs can access hex encoded CF API admin credentials and can push new malicious versions of an application.”
Once obtained the credentials, threat actors can push malicious app versions.
To address the flaw CVE-2023-20891, admins are recommended to install the patches listed in the ‘Fixed Version’ column of the ‘Resolution Matrix’ included in the advisory.
The virtualization giant also recommends all the impacted users of Vmware Tanzu Application Service for VMs and Isolation Segment to do CF API admin credential rotation as per its KB here.
In July, the virtualization giant warned customers of the availability of an exploit code for the critical RCE vulnerability CVE-2023-20864 in the VMware Aria Operations for Logs analysis tool (formerly vRealize Log Insight).
Follow me on Twitter: @securityaffairs Facebook and Mastodon
(SecurityAffairs – hacking, Tanzu Application Service for VMs)
