CVE-2024-37085
MEDIUM KEV RANSOMWAREVMware ESXi - Authentication Bypass via Recreated Active Directory Group
Title source: llmExploitation Summary
CVE-2024-37085 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added July 30, 2024, with confirmed use in ransomware campaigns. EIP tracks 3 public exploits from researchers including mahmutaymahmutay, WTN-arny.
AI-analyzed exploit summary This Python script scans for signs of CVE-2024-37085 exploitation in ESXi by checking authentication logs via SSH. It does not exploit the vulnerability but detects potential exploitation attempts.
Description
VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management https://blogs.vmware.com/vsphere/2012/09/joining-vsphere-hosts-to-active-directory.html by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.
Exploits (3)
This Python script scans for signs of CVE-2024-37085 exploitation in ESXi by checking authentication logs via SSH. It does not exploit the vulnerability but detects potential exploitation attempts.
The repository claims to exploit an unauthenticated shell upload vulnerability in domain-joined ESXi hypervisors but provides no actual exploit code. Instead, it directs users to external download links and requests payment for the exploit.
The repository claims to exploit CVE-2024-37085, an unauthenticated shell upload vulnerability in VMware ESXi, but provides no actual exploit code. Instead, it directs users to external download links and requests payment for the exploit.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H