CVE-2009-3733
published 2009-11-02CVE-2009-3733: Directory traversal vulnerability in VMware Server 1.x before 1.0.10 build 203137 and 2.x before 2.0.2 build 203138 on Linux, VMware ESXi 3.5, and VMware ESX…
PriorityP274medium5CVSS 2.0
AVNACLAuNCPINAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
83.38%
99.6th percentile
Directory traversal vulnerability in VMware Server 1.x before 1.0.10 build 203137 and 2.x before 2.0.2 build 203138 on Linux, VMware ESXi 3.5, and VMware ESX 3.0.3 and 3.5 allows remote attackers to read arbitrary files via unspecified vectors.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| vmware | esx | — | — |
| vmware | esx | — | — |
| vmware | esxi | — | — |
| vmware | server | — | — |
| vmware | server | — | — |
| vmware | server | — | — |
| vmware | server | — | — |
| vmware | server | — | — |
| vmware | server | — | — |
| vmware | server | — | — |
| vmware | server | — | — |
| vmware | server | — | — |
| vmware | server | — | — |
| vmware | server | — | — |
| vmware | server | — | — |
| vmware | server | — | — |
| vmware | server | — | — |
| vmware | vmware_esxi | — | — |
| vmware | vmware_fusion | — | — |
| vmware | vmware_tools | — | — |
| vmware | vmware_workstation | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Alert on HTTP requests to `/sdk/` containing traversal sequences (`../` or `%2E%2E/`) followed by sensitive paths such as `/etc/vmware/hostd/vmInventory.xml`. ↗
- →Monitor HTTP 200 responses from VMware management ports (80, 443, 8222, 8333) containing the XML tag `configroot`, which indicates successful traversal and file retrieval. ↗
- →Inspect HTTP responses for `vmxcfgpath` XML tags, which indicate the server returned VM inventory data via the traversal vulnerability. ↗
- →Scan for vulnerable VMware Server instances on ports 80/8222 (HTTP) and 443/8333 (HTTPS SSL); these are the standard management ports exposed by affected products. ↗
- ·The traversal requires network access to the host; the advisory notes the attacker must have access to the network on which the host resides. ↗
- ·The vulnerability affects VMware Server 1.x (fixed in 1.0.10 build 203137) and 2.x (fixed in 2.0.2 build 203138) on Linux, ESXi 3.5, and ESX 3.0.3/3.5; detection rules should be scoped to these platform/version combinations. ↗
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vulncheck5.0MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-wfqc-2mvj-wfhf: Directory traversal vulnerability in VMware Server 1
ghsa_unreviewed·2022-05-02
CVE-2009-3733 [MEDIUM] CWE-22 GHSA-wfqc-2mvj-wfhf: Directory traversal vulnerability in VMware Server 1
Directory traversal vulnerability in VMware Server 1.x before 1.0.10 build 203137 and 2.x before 2.0.2 build 203138 on Linux, VMware ESXi 3.5, and VMware ESX 3.0.3 and 3.5 allows remote attackers to read arbitrary files via unspecified vectors.
VulnCheck
VMware ESXi Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
vulncheck·2009·CVSS 5.0
CVE-2009-3733 [MEDIUM] VMware ESXi Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
VMware ESXi Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Directory traversal vulnerability in VMware Server 1.x before 1.0.10 build 203137 and 2.x before 2.0.2 build 203138 on Linux, VMware ESXi 3.5, and VMware ESX 3.0.3 and 3.5 allows remote attackers to read arbitrary files via unspecified vectors.
Affected: VMware ESXi
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://info.greynoise.io/hubfs/resources/GreyNoise-2025-Mass-Internet-Exploitation-Report.pdf
VMware
VMware hosted products and ESX patches resolve two security issues
vendor_vmware·2009-10-27·CVSS 6.9
CVE-2009-2267 [MEDIUM] VMware hosted products and ESX patches resolve two security issues
VMSA-2009-0015: VMware hosted products and ESX patches resolve two security issues
a. Mishandled exception on page faults An improper setting of the exception code on page faults may allow for local privilege escalation on the guest operating system. This vulnerability does not affect the host system. VMware would like to thank Tavis Ormandy and Julien Tinnes of the Google Security Team for reporting this issue to us. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2009-2267 to this issue. The following table lists what action remediates the vulnerability (column 4) if a solution is available. VMware Product ============= Product Version ======= Running on ======= Replace with/ Apply Patch ================= VMware Product ============= VirtualCen
No detection rules found.
Exploit-DB
VMware Server 2.0.1 / ESXi Server 3.5 - Directory Traversal
exploitdb·2009-10-27·CVSS 5.0
CVE-2009-3733 [MEDIUM] VMware Server 2.0.1 / ESXi Server 3.5 - Directory Traversal
VMware Server 2.0.1 / ESXi Server 3.5 - Directory Traversal
---
source: https://www.securityfocus.com/bid/36842/info
VMware products are prone to a directory-traversal vulnerability because they fail to sufficiently sanitize user-supplied input data.
Exploiting the issue may allow an attacker to obtain sensitive information from the host operating system that could aid in further attacks.
description = [[
Checks for a path-traversal vulnerability in VMWare ESX, ESXi, and Server (CVE-2009-3733), originally released by Justin Morehouse (justin.morehouse[at)gmail.com) and Tony Flick (tony.flick(at]fyrmassociates.com), and presented at Shmoocon 2010 (http://fyrmassociates.com/tools.html).
]]
---
-- @usage
-- nmap --script http-vmware-path-vuln -p80,443,8222,8333
--
-- @output
--| http-vm
Metasploit
VMware Server Directory Traversal Vulnerability
metasploit
VMware Server Directory Traversal Vulnerability
VMware Server Directory Traversal Vulnerability
This modules exploits the VMware Server Directory Traversal
vulnerability in VMware Server 1.x before 1.0.10 build 203137 and 2.x before
2.0.2 build 203138 on Linux, VMware ESXi 3.5, and VMware ESX 3.0.3 and 3.5
allows remote attackers to read arbitrary files. Common VMware server ports
80/8222 and 443/8333 SSL. If you want to download the entire VM, check out
the gueststealer tool.
No writeups or analysis indexed.
http://lists.vmware.com/pipermail/security-announce/2009/000069.htmlhttp://secunia.com/advisories/37186http://security.gentoo.org/glsa/glsa-201209-25.xmlhttp://securitytracker.com/id?1023088http://securitytracker.com/id?1023089http://www.securityfocus.com/archive/1/507523/100/0/threadedhttp://www.securityfocus.com/bid/36842http://www.vmware.com/security/advisories/VMSA-2009-0015.htmlhttp://www.vupen.com/english/advisories/2009/3062https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7822http://lists.vmware.com/pipermail/security-announce/2009/000069.htmlhttp://secunia.com/advisories/37186http://security.gentoo.org/glsa/glsa-201209-25.xmlhttp://securitytracker.com/id?1023088http://securitytracker.com/id?1023089http://www.securityfocus.com/archive/1/507523/100/0/threadedhttp://www.securityfocus.com/bid/36842http://www.vmware.com/security/advisories/VMSA-2009-0015.htmlhttp://www.vupen.com/english/advisories/2009/3062https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7822
2009-11-02
Published
Exploited in the wild