How to find VMware/Broadcom ESXi installs on your network

Latest Broadcom ESXi vulnerabilities #

Broadcom has disclosed a vulnerability in their ESXi product that involves a domain group that could contain members that are granted full administrative access to the ESXi hypervisor host by default without proper validation.

CVE-2024-37085 is rated medium with CVSS score of 6.8 and allows an attacker with sufficient Active Directory (AD) permissions to bypass authentication.

What is the impact? #

A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD. The three ways this can be exploited are:

1. Creating the AD group 'ESX Admins' to the domain and adding a user to it (known to be exploited in the wild)

2. Renaming another AD group in the domain to 'ESX Admins' and adding a new or existing user to it

3. Refreshing the privileges in the ESXi hypervisor when the 'ESX Admin' group is unassigned as the management group.

Are updates or workarounds available? #

How to find potentially vulnerable systems runZero #

From the Asset Inventory, use the following query to locate systems running potentially vulnerable software:

os:ESXi

Additionally, using the runZero VMware integration, use the following query to locate virtual machines running inside VMware, which could be potential sources of exploitation:

source:vmware or source:broadcom