VRealize Operations Manager API SSRF

A malicious attacker who has the ability to access the VMware™ vRealize Operations Manager API over the network can perform a Server Side Request Forgery(SSRF) attack to steal sensitive credentials of management.

Affected versions

VMware cloud_foundation version 4.x 3.x, VMware vRealize_suite_lifecycle_manager version 8.x, VMware vRealize_operations_manager versions 8.0.0, 8.0.1, 8.3.0, 8.1.0, 8.1.1, 8.2.0, 7.5.0

Impact

Successful exploitation will allow a malicious attacker to execute unauthorized actions such as gaining access to sensitive data, arbitrary code execution, etc.

Mitigation / Precaution

• We recommend you to update VMware for vRealize Operations Manager to the latest version.
• If you cannot apply the patch, there is a workaround that involves editing the home-security-context.xml file and restarting the Cluster Analytic (CaSA) service.

Written by

Nash N Sulthan

Cyber Security Lead Engineer

Nash is a seasoned Security Engineer who brings a multifaceted approach to safeguarding digital environments. Not only does he excel in implementing robust security measures, but he's also deeply involved in the research and development process, constantly innovating to stay ahead of cyber threats. Nash's commitment to security extends beyond the conventional, making him a valuable contributor to the evolving landscape of digital defense.