SERVER-WEBAPP VMware Cloud Foundation NSX Manager XStream remote code execution attempt

IPS-NPA

1 SID: 60793

Description

Detects an attempt to exploit CVE-2021-39144, and CVE-2022-31678, a remote code execution flaw that can run code on the server in VMware Cloud Foundation NSX Manager XStream.

CVEs

CVE-2021-39144 CVE-2022-31678

Related blogs

$Sandbox process tree for the Underground loader, showing an injected dllhost.exe launching chrome.exe and msedge.exe and staging stolen cookies under C:\ProgramData\Underground, before a second dllhost.exe deletes that folder.$

$100k in Crypto Drained by the Underground Operation

October 1, 20268 min read

The Future of Malware is LLM-powered

The Future of Malware is LLM-powered

November 20, 20255 min read

New Evasive Campaign Delivers LegionLoader via Fake CAPTCHA & CloudFlare Turnstile

New Evasive Campaign Delivers LegionLoader via Fake CAPTCHA & CloudFlare Turnstile

April 4, 20258 min read

Threat Labs News Roundup: May 2023

June 9, 20234 min read

Netskope Threat Labs Stats for March 2023

Netskope Threat Labs Stats for March 2023

April 21, 20235 min read

Threat Labs News Roundup: February 2023

March 7, 20234 min read

Two RCE Vulnerabilities Found in Spring Framework

Two RCE Vulnerabilities Found in Spring Framework

April 6, 20222 min read

New Formbook Campaign Delivered Through Phishing Emails

New Formbook Campaign Delivered Through Phishing Emails

March 11, 20229 min read

Netskope Threat Coverage: 2020 Tokyo Olympics Wiper Malware

Netskope Threat Coverage: 2020 Tokyo Olympics Wiper Malware

July 29, 20214 min read

Targeted Attack BadWolf Exploits Office Vulnerabilities to Exfiltrate Data

Targeted Attack BadWolf Exploits Office Vulnerabilities to Exfiltrate Data

December 14, 20175 min read

References

www.vmware.com