- VMware Cloud Foundation contains an unauthenticated remote code execution vulnerability via XStream open source library.
- VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8
_______ _______ __ __ ___ _________
| _ "\ /" __ )|" |/ \| "|(" "\
(. |_) :)(__/ _) ./|' / \: | \___/ :/
|: \/ / // |: /' | / //
(| _ \ __ \_ \ \// /' | __\ ./
|: |_) :)(: \__) :\ / / \ | (: \_/ \
(_______/ \_______)|___/ \___| \_______)
coded by b3w7
usage: vm-xstream.py [-h] [-u URL] [-f FILE] [-c CMD]
options:
-h, --help show this help message and exit
-u URL, --url URL Target URL; Example:http://ip:port
-f FILE, --file FILE Url File; Example:url.txt
-c CMD, --cmd CMD Commands to be executed(whoami as default)
the author don have any responsibility from misusing the tool
made for educational purpose only