CVE-2023-20867
VMware Tools Authentication Bypass Vulnerability
Description
CVE-2023-20867 is an authentication bypass vulnerability in VMware Tools that allows a fully compromised ESXi host to circumvent host-to-guest authentication, impacting the confidentiality and integrity of guest virtual machines. The flaw is classified as improper authentication (CWE-287) and enables an attacker who has already gained control of an ESXi hypervisor to silently manipulate or access data within guest VMs without proper verification. CISA has added CVE-2023-20867 to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Despite its low CVSS score of 3.9, the vulnerability is significant because it has been observed in sophisticated attack chains targeting virtualized infrastructure.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| vmware | tools | >= 10.3.0, < 12.2.5 |
| debian | debian linux | 10.0; 11.0; 12.0 |
| fedoraproject | fedora | 37; 38; 39 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
References
- http://www.openwall.com/lists/oss-security/2023/10/16/11(Mailing List, Patch)
- http://www.openwall.com/lists/oss-security/2023/10/16/2(Mailing List, Patch)
- https://lists.debian.org/debian-lts-announce/2023/08/msg00020.html(Mailing List, Third Party Advisory)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/NVKQ6Y2JFJRWPFOZUOTFO3H27BK5GGOG/(Mailing List, Release Notes)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/TJNJMD67QIT6LXLKWSHFM47DCLRSMT6W/(Mailing List, Release Notes)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/ZJM6HDRQYS74JA7YNKQBFH2XSZ52HEWH/(Mailing List, Release Notes)
- https://security.netapp.com/advisory/ntap-20230725-0001/(Third Party Advisory)
- https://www.debian.org/security/2023/dsa-5493(Mailing List, Third Party Advisory)
- https://www.vmware.com/security/advisories/VMSA-2023-0013.html(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-20867(US Government Resource)
Weakness Type
CWE-287: Improper Authentication
CWE-287 describes a weakness where a system does not properly verify the identity of an actor before granting access to resources or functionality. In CVE-2023-20867, VMware Tools fails to properly authenticate operations initiated from a compromised ESXi host to guest virtual machines, allowing the hypervisor-level attacker to bypass intended host-to-guest authentication controls and interact with guest OS operations without valid credentials.
Learn more: CWE-287 — Improper Authentication
Impact Analysis
CVE-2023-20867 has a CVSS score of 3.9 (Low) under CVSS v3.1, which reflects the narrow attack prerequisites rather than the potential consequence in real-world attack scenarios. The vulnerability requires local access and high attack complexity, meaning exploitation depends on the attacker already having full control of the ESXi hypervisor—a significant prerequisite. High privileges are required as the attacker must have root-level access to the ESXi host, and no user interaction is needed on the guest VM side. Notably, the Scope is Changed, meaning a compromised hypervisor can affect guest VM resources beyond the vulnerable component itself. Confidentiality (Low) and Integrity (Low) impacts indicate the attacker can read and modify some guest VM data through the authentication bypass, while Availability (None) means the guest VM remains operational. The EPSS score of 3.13% (87th percentile) reflects an above-average probability of exploitation, consistent with its confirmed use in targeted campaigns against virtualization infrastructure.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2023-20867 by including it in the Known Exploited Vulnerabilities catalog, with a remediation deadline of July 14, 2023. The vulnerability has been publicly associated with targeted attacks leveraging compromised ESXi hosts to pivot into guest virtual machines, making it a component of multi-stage attack chains against virtualized environments. Patches and security advisories are available from VMware (VMSA-2023-0013), and mailing list discussions on oss-security indicate that the security community has analyzed the vulnerability in detail. The EPSS score of 3.13% places CVE-2023-20867 in the 87th percentile, indicating a meaningfully elevated exploitation probability relative to most vulnerabilities, consistent with its use in real-world targeted operations.
Remediation
- Apply the VMware Tools update immediately as directed by VMware's security advisory VMSA-2023-0013. Upgrade VMware Tools to the latest patched version across all guest virtual machines in your environment.
- Update VMware Tools packages on Linux distributions: for Debian-based systems, apply the update referenced in DSA-5493; for Fedora, install the patched packages announced in the Fedora mailing lists. Check distribution-specific advisories for the correct package version.
- Harden ESXi host access controls to reduce the risk of host compromise, which is the prerequisite for exploiting CVE-2023-20867. Enforce multi-factor authentication for vCenter and ESXi management interfaces, restrict management network access, and review ESXi host SSH and DCUI lockdown policies.
- Monitor for indicators of ESXi host compromise, including unauthorized vMotion operations, unexpected VMware Tools commands executing in guest VMs, anomalous VIB installations, and modifications to ESXi configuration files or firewall rules.
- Implement network segmentation between management and guest VM networks to limit the blast radius of a compromised hypervisor and reduce the attacker's ability to pivot from host to guest operations.
Technical Details
CVE-2023-20867 is an improper authentication vulnerability (CWE-287) in VMware Tools, the guest-side utility suite that facilitates communication between VMware ESXi hypervisors and guest virtual machines. When an ESXi host is fully compromised, the attacker can exploit this flaw to force VMware Tools in guest VMs to fail authentication for host-to-guest operations, effectively bypassing the trust boundary between hypervisor and guest. Attack Vector (Local) reflects that the attacker must have direct access to the ESXi host, while Attack Complexity (High) indicates that exploitation requires the attacker to have already fully compromised the hypervisor—a non-trivial prerequisite involving prior exploitation or credential theft. Privileges Required (High) confirms root-level ESXi access is necessary, and Scope (Changed) is the critical metric here, as the vulnerability allows a compromised hypervisor component to affect the security of guest VM resources that operate under a separate security authority. The authentication bypass enables the attacker to execute host-to-guest operations such as file transfers or command execution without the guest VM properly validating the request origin.
Frequently Asked Questions
Is CVE-2023-20867 being actively exploited?
Yes, CISA has confirmed active exploitation of CVE-2023-20867 by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of July 14, 2023. The vulnerability has been observed in targeted attacks against virtualized infrastructure where attackers leverage compromised ESXi hosts to access guest VMs.
What products are affected by CVE-2023-20867?
CVE-2023-20867 affects VMware Tools across multiple platforms. Additionally, VMware Tools packages distributed through Debian Linux and Fedora are affected. Any environment running VMware Tools on guest virtual machines hosted on ESXi should verify their installed version against VMware's advisory VMSA-2023-0013.
How do I fix CVE-2023-20867?
Update VMware Tools to the latest patched version as specified in VMware's security advisory VMSA-2023-0013. Linux distributions should apply the relevant patches from their package repositories (Debian DSA-5493, Fedora updates). Additionally, harden ESXi host access to reduce the prerequisite attack surface.
How severe is CVE-2023-20867?
CVE-2023-20867 is rated Low severity with a CVSS score of 3.9, primarily because exploitation requires prior full compromise of an ESXi host. However, its inclusion in CISA's KEV catalog and an EPSS score in the 87th percentile indicate that real-world exploitation risk is higher than the base score suggests, particularly in environments with targeted threat exposure.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.