VMware vCenter Server (versions prior to 9.1.0.0300, 9.0.2.0100, 8.0 U3k / 8.0 U2f)
Centralised IT management software that lets organisations control, monitor, and configure all their virtual machines and servers from a single platform.
Root Cause
The Syslog server component fails to validate file path inputs, allowing a crafted request to escape the intended directory and reach sensitive system areas. There are no workarounds. Only patching resolves it.
Attack Vector
An attacker with network access sends a specially crafted request to the vCenter Syslog server. The server processes the malformed path without restriction, granting file access and enabling arbitrary code execution. In active exploitation, attackers then drop the reverse_ssh tool, which phones home to attacker infrastructure, bypassing inbound firewall rules.
Detection Notes
- Look for unexpected outbound SSH connections from vCenter hosts to unknown external IPs.
- Search for reverse_ssh binaries using QUIRSO's published YARA rule — but validate any hits, as the tool also has legitimate uses.
- Check for new, unrecognised processes running under the vCenter service account.
Recommended Actions
- Apply the emergency patch immediately: 9.1.0.0300, 9.0.2.0100, 8.0 U3k, or 8.0 U2f.
- Restrict network access to vCenter — it should never be publicly internet-facing.
- Review outbound connection logs for traffic to unfamiliar infrastructure since August 3.