""ET EXPLOIT Potential External VMware vRealize Automation Authentication Bypass Vulnerability""

SID: 2036725

Revision: 4

Class Type: attempted-admin

Metadata: affected_product VMware, created_at 2022_05_27, deployment Perimeter, deployment Internal, performance_impact Low, confidence Medium, signature_severity Major, updated_at 2024_08_01

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: any

Destination Network: $HOME_NET

Destination Port: any

Flow: established,to_server

Contents:

  • Value: "POST"

  • Value: "/SAAS/auth/login/embeddedauthbroker/callback"

  • Value: "protected_state"

  • Value: "userstore"

  • Value: "username"

  • Value: "password"

  • Value: "userstoreDisplay"

  • Value: "horizonRelayState"

  • Value: "stickyConnectorId"

  • Value: "action"

  • Value: "application/x-www-form-urlencoded"

Within:

PCRE: "/^Content-Type\x3a\x20[^\r\n]+application\x2fx-www-form-urlencoded/Hmi"

Special Options:

  • http_method

  • http_uri

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • http_header

source