This is my proof-of-concept exploit code for the VMware vCenter Directory Service (vmdir) sensitive information disclosure vulnerability (CVE-2020-3952 / VMSA-2020-0006).
It turns out that the vmdir service, which provides an LDAP directory server (and more), allows anonymous LDAP connections (also called LDAP binding) in the ACL MODE: Legacy configuration that is present
after upgrading from vCenter 6.5. While the LDAP tree doesn't expose password
hashes for administrative users, it does expose the VMware SSO server's SAML identity provider (IdP) certificates
and private key. This key can be downloaded and used to sign arbitrary SAML responses, allowing an attacker to
impersonate any valid user without credentials.
Usage:
./exploit.py {vCenter IP address}
This will return a session cookie you can set in your browser to log in as Administrator, e.g.:
> ./exploit.py 192.168.2.201
Set this cookie in your browser:
VSPHERE-UI-JSESSIONID=6C70C88C99BC987AADA3D1EC8196F704
And browse to https://192.168.2.201/ui
The exploit works as follows:
- Download the SSO SAML IdP certificates and private key from the vmdir LDAP server
- Initiate a login request to the vCenter UI to get a SAML authentication request
- Update some parameters in the SAML response template (
saml-response-template.xml) - Sign the assertion in the SAML response using the SSO IdP key to get a valid SAML response
- Log in to the vCenter web UI using the signed response to get a session cookie for a valid administrator session
The SAML response template can be updated to log in as any user with any set of groups.
There is another PoC exploit by Guardicode that adds a new user to the LDAP tree instead.