VMware vSphere ESXi (6.7 prior to ESXi670-201810101-SG, 6.5 prior to ESXi650-201811102-SG, and 6.0 prior to ESXi600-201807103-SG) and VMware vCenter Server (6.7 prior to 6.7 U1b, 6.5 prior to 6.5 U2b, and 6.0 prior to 6.0 U3j) contain an information disclosure vulnerability in clients arising from insufficient session expiration. An attacker with physical access or an ability to mimic a websocket connection to a user’s browser may be able to obtain control of a VM Console after the user has logged out or their session has timed out.

The version of VMware vCenter Server installed on the remote host is 6.0 prior to U3j, 6.5 prior to U3, or 6.7 prior to U3, and is, therefore, affected by the following vulnerabilities:

  - An information disclosure vulnerability caused by     insufficient session expiration. This allows an     attacker with physical access or the ability to mimic     a websocket connection to a user's browser to control a     VM console after the user's session has expired or they     have logged out. (CVE-2019-5531)

  - An information disclosure vulnerability caused by     plain-text logging of virtual machine credentials     through OVF. This allows an attacker with access to the     log files which contain the vCenter OVF-properties of a     virtual machine deployed from an OVF to view the     credentials used to deploy the OVF, which typically     belong to the root account of the virtual machine.
    (CVE-2019-5532)

  - An information disclosure vulnerability in virtual     machines deployed from an OVF which could expose login     information via the virtual machine's vAppConfig     properties. An attacker with access to query the     vAppConfig properties of a virtual machine deployed     from an OVF can view the credentials used to deploy the     OVC, which typically belong to the root account of the     virtual machine. (CVE-2019-5534)     Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote VMware ESXi host is version 6.0, 6.5 or 6.7 and is affected the following vulnerabilities:

  - A remote code execution vulnerability caused by     a failure to sanitize filenames in the tab autocomplete     feature of BusyBox. This allows an attacker to execute     arbitrary code, write arbitrary files, or conduct other     attacks. (CVE-2017-16544)

  - An information disclosure vulnerability caused by     insufficient session expiration. This allows an     attacker with physical access or the ability to mimic     a websocket connection to a user's browser to control     a VM console after the user's session has expired or     they have logged out. (CVE-2019-5531)


Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

a. VMware ESXi busybox command injection vulnerability

ESXi contains a command injection vulnerability due to the use of vulnerable version of busybox that does not sanitize filenames which may result into executing any escape sequence in the shell.

An attacker may exploit this issue by tricking an ESXi Admin into executing shell commands by providing a malicious file. 

b. ESXi Host Client information disclosure vulnerability

An information disclosure vulnerability in clients arising from insufficient session expiration.

An attacker with physical access or an ability to mimic a websocket connection to a users browser may be able to obtain control of a VM Console after the user has logged out or their session has timed out.

ID	Name	Product	Family	Severity
129503	VMware vCenter Server 6.0 / 6.5 / 6.7 Multiple Vulnerabilities (VMSA-2019-0013)	Nessus	Misc.	high
129493	ESXi 6.0 / 6.5 / 6.7 Multiple Vulnerabilities (VMSA-2019-0013)	Nessus	Misc.	high
128994	VMSA-2019-0013 : Command injection and information disclosure vulnerabilities	Nessus	VMware ESX Local Security Checks	high

Detections

Analytics

CVE-2019-5531

medium

Tenable Plugins

high

high

high