CVE-2017-4914
published 2017-06-07CVE-2017-4914: VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x contains a deserialization issue. Exploitation of this issue may allow a remote attacker to…
PriorityP267critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
8.83%
94.6th percentile
VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x contains a deserialization issue. Exploitation of this issue may allow a remote attacker to execute commands on the appliance.
Affected
28 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| vmware | vcenter_server | — | — |
| vmware | vmware_vsphere | — | — |
| vmware | vsphere_data_protection | — | — |
| vmware | vsphere_data_protection | — | — |
| vmware | vsphere_data_protection | — | — |
| vmware | vsphere_data_protection | — | — |
| vmware | vsphere_data_protection | — | — |
| vmware | vsphere_data_protection | — | — |
| vmware | vsphere_data_protection | — | — |
| vmware | vsphere_data_protection | — | — |
| vmware | vsphere_data_protection | — | — |
| vmware | vsphere_data_protection | — | — |
| vmware | vsphere_data_protection | — | — |
| vmware | vsphere_data_protection | — | — |
| vmware | vsphere_data_protection | — | — |
| vmware | vsphere_data_protection | — | — |
| vmware | vsphere_data_protection | — | — |
| vmware | vsphere_data_protection | — | — |
| vmware | vsphere_data_protection | — | — |
| vmware | vsphere_data_protection | — | — |
| vmware | vsphere_data_protection | — | — |
| vmware | vsphere_data_protection | — | — |
| vmware | vsphere_data_protection | — | — |
| vmware | vsphere_data_protection | — | — |
| vmware | vsphere_data_protection | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
4a 52 4d 49 00 02 4b
bytes↗
ac ed 00 05
- →Monitor for inbound TCP connections to port 1099 (Java RMI registry) on VDP appliances; the exploit initiates a raw socket connection to this port and sends a crafted JRMI handshake header (0x4a 0x52 0x4d 0x49 0x00 0x02 0x4b) followed by a Java serialized object payload (magic bytes 0xac 0xed 0x00 0x05). ↗
- →Detect Java deserialization payloads leveraging Apache Commons Collections ChainedTransformer / InvokerTransformer gadget chain; look for the class name strings 'org.apache.commons.collections.functors.ChainedTransformer' and 'org.apache.commons.collections.functors.InvokerTransformer' in network streams on port 1099. ↗
- →The exploit supports both plaintext and TLS-wrapped (TLSv1) connections to port 1099; inspect SSL/TLS traffic to VDP appliances on this port for the JRMI header and serialized payload patterns. ↗
- →The deserialization payload encodes a Runtime.exec() call; alert on VDP appliance processes spawning unexpected child processes, which would indicate successful exploitation of the Java deserialization issue. ↗
- ·The exploit sends the hardcoded source IP string '127.0.0.1' inside the RMI payload header regardless of the actual attacker IP; this spoofed value should not be relied upon for attribution. ↗
- ·The exploit accepts the target command as a free-form argument (sys.argv[4]); the command length byte is dynamically computed and inserted, meaning payload length varies per command — length-based signatures alone are insufficient for detection. ↗
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VMware
vSphere Data Protection (VDP) updates address multiple security issues.
vendor_vmware·2017-06-06·CVSS 9.8
CVE-2017-4914 [CRITICAL] vSphere Data Protection (VDP) updates address multiple security issues.
VMSA-2017-0010: vSphere Data Protection (VDP) updates address multiple security issues.
a. VDP Java deserialization issue VDP contains a deserialization issue. Exploitation of this issue may allow a remote attacker to execute commands on the appliance. VMware would like to thank Tim Roberts, Arthur Chilipweli, and Kelly Correll from NTT Security for reporting this issue to us. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2017-4914 to this issue. Column 5 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available. VMware Product Product Version Running on Severity Replace with/ Apply Patch Mitigation/ Workaround VMware ProductVDP Product Version6.1.x Running on VA SeverityCr
GHSA
GHSA-8q56-88xv-7qx3: VMware vSphere Data Protection (VDP) 6
ghsa_unreviewed·2022-05-17
CVE-2017-4914 [CRITICAL] CWE-502 GHSA-8q56-88xv-7qx3: VMware vSphere Data Protection (VDP) 6
VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x contains a deserialization issue. Exploitation of this issue may allow a remote attacker to execute commands on the appliance.
No detection rules found.
No writeups or analysis indexed.
http://www.securityfocus.com/bid/98939http://www.securitytracker.com/id/1038617http://www.vmware.com/security/advisories/VMSA-2017-0010.htmlhttps://www.exploit-db.com/exploits/42152/http://www.securityfocus.com/bid/98939http://www.securitytracker.com/id/1038617http://www.vmware.com/security/advisories/VMSA-2017-0010.htmlhttps://www.exploit-db.com/exploits/42152/
2017-06-07
Published