French company Vates, which develops Xen Orchestra, the tool for managing XCP-ng virtualization servers, warned that a critical flaw in the product is being actively exploited. According to BleepingComputer, the flaw lets an attacker with network access to the management interface bypass authentication using a specially crafted cookie and gain administrator rights. From there, the road to taking over the virtualization servers, and every virtual machine running on them, is short.
Vates has released patched versions. According to reports, at the time of publication no CVE number or official severity score had been assigned, which may cause some organizations to miss it in automated tools that track vulnerabilities by CVE number.
Why does this matter now? After Broadcom acquired VMware and raised prices sharply, many organizations around the world, including in Israel, looked for alternatives. XCP-ng and Xen Orchestra, open-source solutions with commercial support, are among the popular ones. But a rapid move to a new system is not always accompanied by the same level of hardening. A management interface exposed to the network, and sometimes to the internet, is exactly what attackers look for.
Virtualization servers are an especially favored target for ransomware gangs: whoever controls the host controls every server on it and can encrypt dozens of machines at once. In recent years we saw the same pattern in attacks on VMware ESXi, and now attackers are reaching the alternatives too.
What to do? Update Xen Orchestra to the patched version immediately. Make sure the management interface is not exposed to the internet and is in any case reachable only from an isolated management network or via VPN. And check logs for unusual logins in recent days. Anyone who moved from VMware to save money should remember the savings vanish in one moment of a ransomware attack.
