Zero-Day Advisory
Fortinet Discovers VMware ESXi Command Injection Vulnerability
Summary
Fortinet's FortiGuard Labs has discovered a Command Injection vulnerability in VMware ESXi.
VMware ESXi is a purpose-built bare-metal hypervisor that installs directly onto a physical server.
A Command Injection vulnerability has been discovered in VMware ESXi 6.0, 6.5 and 6.7. The vulnerability exists because ESXi is using an old version of busybox 1.22.1 which contains this vulnerability. The vulnerability allows users with permission to create or upload a file with the crafted filename which could result in code execution, arbitrary file write, or other attacks.
Solutions
Users should apply the solution provided by VMware.
Timeline
Fortinet reported the vulnerability to VMware on August 6, 2018.
VMware confirmed the vulnerability on August 29, 2018.
VMware patched the vulnerability on September 16, 2019.