On day two, CSIRT-ITA added mitigation and detection guidance for two actively exploited flaws in Vates’ Xen Orchestra and Xen Orchestra Appliance. The affected Xen Orchestra releases are 6.9.x before 6.9.2 and 6.10.x before 6.10.1.
One malformed login cookie becomes an empty search filter, so Xen Orchestra returns its first valid user token and signs the attacker in as its owner—potentially an administrator. That access can run arbitrary code across managed pools and compromise XCP-ng nodes. A separate flaw lets users with limited permissions import a crafted Xen virtual appliance (XVA) file; Xen Orchestra passes its unsafe settings to the Xen API (XAPI) with pool-admin privileges, allowing the import to cross those permissions and reach the host.
If Xen Orchestra manages production virtualization, the console is only one boundary: either path can leave compromised systems inside pools or XCP-ng nodes, so restoring the manager alone may not restore trust in its managed estate.
Vates: rilevato sfruttamento in rete di vulnerabilità in Xen Orchestra
Vates ha rilevato lo sfruttamento in rete di vulnerabilità che interessano Xen Orchestra e Xen Orchestra Appliance, soluzioni per la gestione centralizzata di infrastrutture di virtualizzazione basate su XCP-ng e Xen.