Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers
A critical authentication bypass vulnerability in Xen Orchestra is being actively exploited in attacks that could grant administrator privileges and allow takeover of XCP-ng virtualization hosts.
A critical authentication bypass vulnerability in Xen Orchestra is being actively exploited in attacks that could grant administrator privileges and allow takeover of XCP-ng virtualization hosts.
Xen Orchestra is a web-based management platform developed by French software company Vates, used to manage XCP-ng virtualization environments, including virtual machines, hosts, and pools.
According to a Vates security advisory, the flaw stems from how Xen Orchestra processes authentication tokens sent through REST API requests.
Xen Orchestra compromise can lead to arbitrary code execution on managed pools and a full XCP-ng node takeover as root, warns Vates.
The company has released Xen Orchestra 6.9.1 (stable) and 6.10.0 (latest), including patched xo-server packages 5.211.2 and 5.213.1 to fix these security vulnerabilities.
Once authenticated, attackers can retrieve reusable login token IDs through the /rest/v0/users/me/authentication_tokens REST API endpoint, which can be used for further access.
Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
An adversary can bypass authentication and perform actions with 'Admin' privilege.
Administrators should install the update immediately, and if not possible, restrict Xen Orchestra access to dedicated management networks and block known malicious IP addresses.
Security researchers Filip Magic and Christoffer Olsen of TDC NET Security discovered the vulnerability.
Vates confirmed that the vulnerability is being actively exploited and shared the following indicators of compromise (IOCs) to help administrators identify attacks: Attacker's infrastructure: Connections to 91.211.251.112:8001 or ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid.onion:3333.
Modified VM configurations: Virtual machines configured with the hvm_serial: file parameter.
Administrators can also run the following commands on XCP-ng hosts to check for unusual VM configurations, virtual machines configured to use a file for its serial port, and malicious files: The company also says these IOCs are only associated with this known attack campaign and may differ for other threat actors.
Companies that believe they are compromised should rotate passwords and secrets used by their virtualization environments.
What happened
A critical authentication bypass vulnerability in Xen Orchestra is being actively exploited in attacks that could grant administrator privileges and allow takeover of XCP-ng virtualization hosts.
Xen Orchestra is a web-based management platform developed by French software company Vates, used to manage XCP-ng virtualization environments, including virtual machines, hosts, and pools.
According to a Vates security advisory, the flaw stems from how Xen Orchestra processes authentication tokens sent through REST API requests.
What changed
Xen Orchestra compromise can lead to arbitrary code execution on managed pools and a full XCP-ng node takeover as root, warns Vates.
The company has released Xen Orchestra 6.9.1 (stable) and 6.10.0 (latest), including patched xo-server packages 5.211.2 and 5.213.1 to fix these security vulnerabilities.
Who is affected
Once authenticated, attackers can retrieve reusable login token IDs through the /rest/v0/users/me/authentication_tokens REST API endpoint, which can be used for further access.
Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
Why it matters
An adversary can bypass authentication and perform actions with 'Admin' privilege.
Administrators should install the update immediately, and if not possible, restrict Xen Orchestra access to dedicated management networks and block known malicious IP addresses.
Technical details
Security researchers Filip Magic and Christoffer Olsen of TDC NET Security discovered the vulnerability.
Vates confirmed that the vulnerability is being actively exploited and shared the following indicators of compromise (IOCs) to help administrators identify attacks: Attacker's infrastructure: Connections to 91.211.251.112:8001 or ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid.onion:3333.
Modified VM configurations: Virtual machines configured with the hvm_serial: file parameter.
Response
Administrators can also run the following commands on XCP-ng hosts to check for unusual VM configurations, virtual machines configured to use a file for its serial port, and malicious files: The company also says these IOCs are only associated with this known attack campaign and may differ for other threat actors.
Companies that believe they are compromised should rotate passwords and secrets used by their virtualization environments.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.