The vulnerability, identified as CVE-2024-37085, has been assigned a “medium” severity score of 6.8 out of 10 on the CVSS scale. This score reflects the fact that attackers need existing permissions in a target’s Active Directory (AD) to exploit it.
However, if attackers have AD access, they can inflict substantial damage. The CVE-2024-37085 bug allows them to instantly elevate their ESXi privileges to the highest level, enabling the deployment of ransomware, data theft, lateral movement within the network, and more.
Notably, groups such as Storm-0506 (also known as Black Basta), Storm-1175, Manatee Tempest (part of Evil Corp), and Octo Tempest (also known as Scattered Spider) have utilized this vulnerability to distribute ransomware like Black Basta and Akira.
Broadcom has released a fix for the vulnerability, which is available on its website.
The vulnerability arises in scenarios where organizations configure their ESXi hypervisors to use AD for user management. By default, ESXi hypervisors grant full administrative access to any member of an AD domain group named “ESX Admins.” This oversight means that an attacker with sufficient AD privileges can create an “ESX Admins” group in the targeted domain and add a user to it, thereby gaining full administrative access to the ESXi hypervisors. Alternatively, they could rename an existing group to “ESX Admins” and use one of its existing users or add a new one.
This vulnerability is problematic because ESXi hypervisors do not validate the existence of the “ESX Admins” group when joining a domain. The membership in this group is determined by name rather than by security identifier (SID), making the exploit straightforward. An attacker only needs to create or rename a group to “ESX Admins” to exploit the vulnerability.
Ransomware attacks targeting ESXi hypervisors and virtual machines (VMs) have become increasingly common, particularly since 2020, as enterprises have accelerated their digital transformation efforts and adopted modern hybrid cloud and virtualized on-premise environments.
Virtualized environments offer hackers significant advantages, as hypervisors typically run many VMs simultaneously, making them ideal targets for widespread ransomware deployment. These VMs often host critical services and business data, making successful attacks highly disruptive.
The limited visibility and protection for hypervisors from traditional security products exacerbate this issue. Hypervisors’ isolation and complexity, along with the specialized knowledge required to protect them, make it difficult for conventional security tools to monitor and safeguard the entire environment.
Additionally, API integration limits further complicate protection efforts.
To mitigate these risks, Microsoft emphasizes the importance of keeping systems up to date with patches and practicing broader cyber hygiene around critical and vulnerable assets. Ensuring that systems are patched and that cyber hygiene practices are in place can help defend against such attacks. As ransomware actors increasingly target these systems, organizations must remain vigilant and proactive in their cybersecurity measures.
