Beware when contracting enterprise based products to solve your ERP needs, as you don’t know when and what type of vulnerability it brings, this just in! Cybercrime researchers from Citadelo have confirmed on its current vulnerability analysis report the verified exploitation of VMWare Cloud Director application. The firm was situated in Prague and worked as a contracted ethical hacking company to test cloud infrastructure used by a prominent company that belongs to Fortune 500.
Their analysis report concluded a rate of 8.8 out of 10 vulnerability scale based on the test that they run with the VMWare Cloud Director application. As the top list used application for managing cloud services, this conclusion report is a significant impact on the brand.
More information on the exploit
VMWare Cloud Director is a widely used platform that caters to large businesses cloud services requirements, including automation. Using the application will give centralized ease of management to all virtual machines and promised cloud providers of a well secure, efficient, and elastic cloud resources. The application’s purpose is its usability in different geographical locations across the world. Another unique capability that makes it a popular software is its versatility. Administrators and developers of the company can easily customize the cloud functions to fit the business needs.
However, this sophisticated platform had known its vulnerability, with the code injection test CVE-2020-3956. Using the test result, with compromised access, it can infiltrate the whole system obtaining sensitive information such as names, email addresses, and IP addresses of logged users remotely. It can also modify the existing environment assigned to regular users up to escalated privileged users. The most lethal it can do about its vulnerability is to steal system database content and login credentials. Once the data falls to a threat actor’s hands and uses it for malicious acts, it will result in damage to the whole organization.
How whitehat penetration testing saves
Fortunately, the discovery of this vulnerability is just a test from an ethical firm. As soon as the report has been passed to the VMWare, as brand protection, they were able to immediately create and release patch update to resolve the lapses on the platform to the affected version of it. They even provide a mitigation plan and assistance to businesses that unable to perform the patch update due to software used compatibility.
As many developers had said, vulnerability is always present in any application or program. In the case of cloud infrastructure, despite its multi-layered enforced security implemented from its core, hackers can still penetrate at its will. We must always be vigilant and proactive by performing malware detection through manual or automated scanning to ensure the safety of the whole business infrastructure.
