CVE-2023-34048: VMware vCenter Server - Out-of-Bounds Write

id: CVE-2023-34048

info:
  name: VMware vCenter Server - Out-of-Bounds Write
  author: ritikchaddha
  severity: critical
  description: |
    vCenter Server contains an out-of-bounds write caused by a vulnerability in the DCERPC protocol implementation. A malicious actor with network access can trigger remote code execution on vCenter Server.
  reference:
    - https://www.vicarius.io/vsociety/posts/understanding-cve-2023-34048-a-zero-day-out-of-bound-write-in-vcenter-server
    - https://www.vmware.com/security/advisories/VMSA-2023-0023.html
    - https://nvd.nist.gov/vuln/detail/CVE-2023-34048
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-34048
    epss-score: 0.92225
    epss-percentile: 0.99698
    cwe-id: CWE-787
  metadata:
    verified: true
    max-request: 2
    vendor: vmware
    product: vcenter_server
    shodan-query: title:"VMware VCenter"
    fofa-query: title="VMware VCenter"
  tags: cve,cve2023,vmware,vcenter,rce,kev,vkev,passive

http:
  - raw:
      - |
        GET /en/welcomeRes.js HTTP/1.1
        Host: {{Hostname}}

      - |
        POST /sdk/ HTTP/1.1
        Host: {{Hostname}}

        <?xml version="1.0" encoding="UTF-8"?>
        <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
           <soap:Header>
              <operationID>00000001-00000001</operationID>
           </soap:Header>
           <soap:Body>
              <RetrieveServiceContent xmlns="urn:internalvim25">
                 <_this xsi:type="ManagedObjectReference" type="ServiceInstance">ServiceInstance</_this>
              </RetrieveServiceContent>
           </soap:Body>
        </soap:Envelope>


    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "VMware vCenter"
          - "VirtualCenter"
          - "VMware"
        case-insensitive: true

      - type: status
        status:
          - 200

      - type: dsl
        dsl:
          - compare_versions(version, '>= 4.0', '<= 5.5')
          - compare_versions(version, '>= 7.0', '<= 8.0')

    extractors:
      - type: regex
        name: version
        part: body
        group: 1
        regex:
          - 'vCenter Converter Standalone ([0-9.]+)'
          - "<version>(.*?)</version>"
# digest: 4a0a0047304502204ac08d0558fc64ecc524ce4f4426e1e44c7861fe508fcc736e5668a7844265e9022100b984fe73eba917bbad47cb6be1d8074715da87c5b821b322edae36ad7a7b9db7:922c64590222798bb761d5b6d8e72950