Critical Xen Orchestra Flaws Exploited in Attacks - SecurityWeek
A threat actor is exploiting critical-severity authentication bypass and zero-day vulnerabilities in Xen Orchestra, software maker Vates warns, with fixes still pending for one issue.
The critical flaw exists in Xen Orchestra's REST authentication mechanism, where an authentication token is manipulated to bypass security controls. This allows unauthenticated attackers to gain administrator privileges on the virtualization management platform.
Xen Orchestra serves as a web-based backup, management, and disaster recovery solution for XCP-ng and XenServer virtualization environments, operating as an agentless control center across hosts, virtual machines, storage, and pools.
Xen Orchestra compromise can lead to arbitrary code execution on managed pools and a full XCP-ng node takeover as root.
Active Exploitation
Vates confirmed that the same threat actor has been exploiting both this authentication bypass and a zero-day vulnerability that requires administrator privileges. The zero-day allows malicious VM imports that could compromise XCP-ng hosts.
The attacker initially operated from IP address 91.211.251.112:8001 and via the Tor network. No CVE identifier has been assigned to either security defect.
Mitigation Steps
The company recommends placing Xen Orchestra instances behind a dedicated network, blocking known malicious IP addresses and domain names, implementing WAF rules to block empty tokens, and rotating all potentially compromised credentials.
In case of a confirmed compromise, a full reinstallation is recommended as cleanup alone cannot guarantee the removal of all backdoors left by the attacker.
Vates warns that unauthorized access isn't logged and has shared limited indicators of compromise (IoCs) specific to this campaign. The company emphasizes that exploitation by other threat actors cannot be ruled out.
Related
