“Vulnerabilities that allow this kind of attack (command injection), can quite often be found in products for administration,” Egor Dimitrenko explains. “Such errors are usually caused by insufficient verification of user input, which subsequently fall into the context of the system command call. Mechanisms to prevent such attacks are normally built into the developer tools, protecting against the possibility of code errors. Nevertheless, there are still anomalies in the code that occurred, for example, when hastily implementing new functionality or as a result of eliminating an existing problem during hotfixes. To exploit the vulnerability found in the VMware product, attackers need credentials. These can be obtained due to the use of weak passwords or by means of social engineering.”

Organizations should follow the recommendations from VMware's official notice to fix the vulnerability. If it is not possible to install an update, then organizations can detect signs of penetration using SIEM solutions that help identify suspicious behavior on the server, register an incident, and prevent the intruders from moving laterally within the corporate network in a timely manner (this is how MaxPatrol SIEM works).

In September 2020, Positive Technologies discovered vulnerabilities of the same class (enabling command injection) in PAN-OS, the operating system used by Palo Alto Networks' next-generation firewalls (NGFW).